4

I have three systems, and I want to have them doing backups between them periodically. The two of them, have Debian Wheezy installed and the other one has Ubuntu 12.04 installed. Only the Ubuntu has a GUI environment, while the other two are CLI only.

For the backups I want to use rsync via ssh, with the Debian systems being the destinations of the backups. I have the commands sorted out and the ssh keys properly generated and copied among the systems, but since the Debian systems do not have a graphical environment installed, the ssh-agent is not run automatically. Therefore, whenever I try to ssh to the Debian systems, I get a prompt for the passphrase.

Is there a way to skip the prompt? From what I understand I cannot use the ssh-agent, when I only have the CLI. I am looking for a solution that works even after a restart without me doing anything after reboot.

Thanks in advance.

  • Take a look at the keychain package. I'm not sure if it will do what you want, but it does cache the keys in memory in some fashion. And it does not require X to work. – Faheem Mitha Dec 1 '14 at 9:25
7

I would create a separate specific passwordless SSH key for this purpose. On the server side, you can set limits to what that key can be used for and where it can connect from, so that even if someone gets hold of the key, they would still not be able to use it to do something malicious.

The way to limit the key is to edit the authorized_keys file on the server side, and add some configuration to it. Here's an example:

from="10.1.2.3",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/path/to/rsync" ssh-dss AA....[rest of key]
4

You can use SSH keys which have no passphrase.

If you don't like that idea then you can create a key file without passphrase and put it into a RAM disk. Thus after a reboot you would have to log in manually in order to prepare the system for batch SSH usage by entering the passphrase and providing the new file. In the ssh calls you would have to provide this file:

ssh -i /tmpfs/no_passphrase.key ...
  • You can use SSH keys which have no passphrase. If you don't like that idea then you can create a key file without passphrase [...] This doesn't make sense. – nyuszika7h Dec 1 '14 at 16:30
  • 1
    @nyuszika7h "and put it into a RAM disk" so it's never stored on the hard disk – Izkata Dec 1 '14 at 16:33
  • Then why are you talking about entering the nonexistent passphrase later on? [...] prepare the system for batch SSH usage by entering the passphrase [...] – nyuszika7h Dec 1 '14 at 16:34
  • 1
    @nyuszika7h I'm not Hauke, but by storing it in a RAM disk you have to recreate the key after a reboot, since it no longer exists. This would require the user's password/phrase – Izkata Dec 1 '14 at 16:40
1

Take a look at the keychain package. I'm not sure if it will do what you want, but it does cache the keys in memory in some fashion. And it does not require X to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.