How to automatically add keyfile and passphrase to ssh-agent?

Question

Linux 4.4.0-34-generic #53-Ubuntu SMP Wed Jul 27 16:06:39 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

I use the script to start ssh-agent and start other script (which is using expect to sent passphrase to agent).

#!/bin/bash
eval `ssh-agent -s`
/root/script2

/root/script2:

#!/usr/bin/expect -f
spawn ssh-add /root/.ssh/key
expect "Enter passphrase for /root/.ssh/key:"
send "passphrase\n";
interact

All scripts are +x Passphrase is valid 100%

After starting first script I get:

Agent pid 3985
spawn ssh-add /root/.ssh/key
Enter passphrase for /root/.ssh/key:
Identity added: /root/.ssh/key (/root/.ssh/key)

As you see, agent started and Identity added BUT when I try "ssh-add -l" I get:

Error connecting to agent: No such file or directory

But process is still working with 3985 PID. Why it tells me Identity added but ssh-add -l didn't work? :(

Ok, I try manually eval ssh-agent and add keyfile:

root@:~# eval `ssh-agent -s`
Agent pid 4063
root@:~# ssh-add -l
The agent has no identities.
root@:~# ssh-add /root/.ssh/key
Enter passphrase for /root/.ssh/key:
Identity added: /root/.ssh/key (/root/.ssh/key)
root@:~# ssh-add -l
4096 SHA256:FxPiCFYOiRree0ogNPpo81DTDUqmr1Brlo0LFnFK12o /root/.ssh/key (RSA)

Why it work when I try to run it manually? How to fix that? I want to add that to rc.local to autostart it when PC starts.

UPD if I try to run only script2 manually, it works (key adds to agent). So I thing problem is with eval sh-agent, but I don't know what's wrong

Answer 1

First, let's get this out of the way: under no circumstances should you be using expect or something like it to feed a password into ssh-add. Since you've stored the password in plaintext on disk anyway, you might as well just have a key with no passphrase. You can add such a key to an agent automatically without using hacks like expect at all.

Of course, only use such a passwordless key for automation that needs to trigger specific actions over SSH, and severely restrict what actions such a key is allowed to invoke using SSH forced commands.

Now as yo the reason your solution doesn't work:

#!/bin/bash
eval `ssh-agent -s`
/root/script2

This script (which has no bash-isms so you might as well have used #!/bin/sh which is more portable) starts an agent and saves its details into its environment, then runs your other script, then exits. When the script ceases running, so do the environment variables in which you saved the agent's details.

You need to run

eval `ssh-agent -s`

in the shell where you actually want to save (and re-use) the agent connection details.

Anyway, since your key is passwordless, do you really need an agent at all? It's less complicated to do:

ssh -i ~/place/where/the/key/lives -l username server restricted-command

So that the ssh client just reads the key directly instead of through an agent.

Finally, it looks like you might be doing all of this as root. Unless there is a very good reason for that, do all of this work in an unprivileged role account.

Answer 2

Please do not ever follow advice telling you to make your private keys less secure by removing a passphrase. Unlike Windows, apparently Linux variants do not provide a version of ssh-agent that allows for permanently storing your private key securely, which is highly unfortunate, but is not an excuse to follow poor advice suggesting you remove the passphrase altogether from anyone who doesn't have a solution for Linux's failure in this regard. There are plenty of examples here about how to accomplish what you'd like, such as: How to start and use ssh-agent as systemd service?. Even better and more in depth with different scenarios is: How can I run ssh-add automatically, without a password prompt?.