1

I installed keychain and added this to my .bashrc in CentOs to help manage my SSH Keys:

/usr/bin/keychain --clear $HOME/.ssh/id_rsa
source $HOME/.keychain/$HOSTNAME-sh

So on SSH login I am prompted to enter the key's password which will endure until reboot or session termination.

While this is enabled any SFTP login attempts are then halted at authentication. How can I leave keychain support enabled while disregarding for SFTP logins? Is this possible? I don't want to have to enable/disable when I need to do things.

2

It looks like your login shell is bash, and your SSH server is configured to invoke your login shell to run the SFTP server.

You can set up sshd to run the SFTP server directly by putting a line like the following in /etc/sshd_config:

Subsystem sftp /usr/lib/openssh/sftp-server

or

Subsystem sftp internal-sftp

You can also fix the problem by changing your .bashrc. This has the side benefit of also fixing problems with other non-interactive uses of ssh, such as scp, rsync, etc. There is a design bug in bash: it loads .bashrc for interactive non-login shells, and for non-interactive remote login shells, even though the two situations have absolutely nothing in common. Add a guard at the top of your .bashrc to ignore the rest of the file in a non-interactive setting:

[[ $- = *i* ]] || return
  • Great answer - thanks! I also found that I could just add some logic in .bashrc to determine the source and act accordingly in this question – Jared Eitnier Sep 14 '14 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.