6

I'm on a Mac (OSX).

I've accidentally deleted my ssh keys, but I haven't restarted my computer yet so I'm still able to access servers with my key. I guess the ssh-agent has some form of it in memory?

Is there any way to retrieve the key from the ssh-agent? I still remember the password etc.

1
  • 11
    While you still have access to your servers, generate new keys and copy them across. Then backup your keys somewhere...
    – jasonwryan
    Commented Sep 5, 2015 at 3:30

2 Answers 2

7

Depends on how much time you have. If you know C than the safest way is to connect with gdb to the ssh-agent process (must be root) and print the key data. Identity keys are stored in an array called idtable which contains a linked list of identities. So, you can print the BIGNUM data (as defined in (1)) like:

(gdb) call BN_bn2hex(idtable[2]->idlist->tqh_first->key->rsa->n)

where the number 2 is the version (you probably need 2) and the last element is one of the BIGNUM (the rest are engine, e, d, p, q, dmp1, dmq1, iqmp).

Now to use this data you need to write a small utility program where you define a RSA struct (defined as in (1)) and populate them. Probably you could write another utility program to do this automatically but then you need more time, you can just print the data manually. Then you call the PEM_write_RSAPrivateKey (2) function with the above RSA data and you have a new unencrypted rsa file.

Sorry for not having more details but if you have time it could be a starting point.

(1) /usr/include/openssl/rsa.h

(2) see man page for pem(3)

2
  • Hmm, this looks promising I might run with it even though I'm not very good with C. I was playing around with what this guy has github.com/NetSPI/sshkey-grab (manually inspecting the stack memory) but I only managed to find the e and n keys. I've tried poking around in the ssh-agent process with lldb and gdb but I couldn't find anything. In gdb it complains about no symbol table info available.
    – James
    Commented Sep 6, 2015 at 2:12
  • @James You need the debugging symbols for this to work. I don't know about Mac's, but usually in the Linux world is another package you need to install like openssh-debuginfo (make sure the version matches the running executable).
    – nkms
    Commented Sep 6, 2015 at 6:55
2

No, there is no way how to get the private keys stored in ssh-agent, because it would be violation of the thing what is the agent made for. I recommend you to create new ones as the comment hints.

On Mac, there is some way-back machine, which should give you your backup, isn't it? Or how did you delete them? Nothing in trash?

5
  • 5
    Of course it's possible to get the keys stored in the agent. That's the whole point of the agent. SSH contacts the agent and gets the key. And even if the protocol was different and ssh-agent did the crypto on behalf of the SSH client, the keys would be in the memory of the ssh-agent process and could be retrieved by dumping its memory. Commented Sep 5, 2015 at 14:19
  • 1
    I don't consider this as a standard way of doing so. Yes, you can do that, but you would spend much more time with it than with regenerating the keys.
    – Jakuje
    Commented Sep 5, 2015 at 15:02
  • 4
    "Or how did you delete them? Nothing in trash?" Quite embarrassing really, I wrote a script with a mkdir -p ~/a/b/c/etc.etc. After a couple test runs I realized instead of resolving the tilde it had just created a folder named ~ in my script directory with a bunch of stuff inside. My first reaction to seeing this folder was to run rm -rf ~. I let it run for a couple seconds before realizing that it was probably not doing what I wanted it to do.
    – James
    Commented Sep 6, 2015 at 2:21
  • AND NOW I HAVE NO SSH KEYS
    – James
    Commented Sep 6, 2015 at 2:22
  • 1
    Thank you all four downvoters who took their time to downvote this post without leaving any constructive comment.
    – Jakuje
    Commented May 11, 2017 at 14:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .