1

Linux 4.4.0-34-generic #53-Ubuntu SMP Wed Jul 27 16:06:39 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

I use the script to start ssh-agent and start other script (which is using expect to sent passphrase to agent).

#!/bin/bash
eval `ssh-agent -s`
/root/script2

/root/script2:

#!/usr/bin/expect -f
spawn ssh-add /root/.ssh/key
expect "Enter passphrase for /root/.ssh/key:"
send "passphrase\n";
interact

All scripts are +x Passphrase is valid 100%

After starting first script I get:

Agent pid 3985
spawn ssh-add /root/.ssh/key
Enter passphrase for /root/.ssh/key:
Identity added: /root/.ssh/key (/root/.ssh/key)

As you see, agent started and Identity added BUT when I try "ssh-add -l" I get:

Error connecting to agent: No such file or directory

But process is still working with 3985 PID. Why it tells me Identity added but ssh-add -l didn't work? :(

Ok, I try manually eval ssh-agent and add keyfile:

root@:~# eval `ssh-agent -s`
Agent pid 4063
root@:~# ssh-add -l
The agent has no identities.
root@:~# ssh-add /root/.ssh/key
Enter passphrase for /root/.ssh/key:
Identity added: /root/.ssh/key (/root/.ssh/key)
root@:~# ssh-add -l
4096 SHA256:FxPiCFYOiRree0ogNPpo81DTDUqmr1Brlo0LFnFK12o /root/.ssh/key (RSA)

Why it work when I try to run it manually? How to fix that? I want to add that to rc.local to autostart it when PC starts.

UPD if I try to run only script2 manually, it works (key adds to agent). So I thing problem is with eval sh-agent, but I don't know what's wrong

4

First, let's get this out of the way: under no circumstances should you be using expect or something like it to feed a password into ssh-add. Since you've stored the password in plaintext on disk anyway, you might as well just have a key with no passphrase. You can add such a key to an agent automatically without using hacks like expect at all.

Of course, only use such a passwordless key for automation that needs to trigger specific actions over SSH, and severely restrict what actions such a key is allowed to invoke using SSH forced commands.

Now as yo the reason your solution doesn't work:

#!/bin/bash
eval `ssh-agent -s`
/root/script2

This script (which has no bash-isms so you might as well have used #!/bin/sh which is more portable) starts an agent and saves its details into its environment, then runs your other script, then exits. When the script ceases running, so do the environment variables in which you saved the agent's details.

You need to run

eval `ssh-agent -s`

in the shell where you actually want to save (and re-use) the agent connection details.

Anyway, since your key is passwordless, do you really need an agent at all? It's less complicated to do:

ssh -i ~/place/where/the/key/lives -l username server restricted-command

So that the ssh client just reads the key directly instead of through an agent.

Finally, it looks like you might be doing all of this as root. Unless there is a very good reason for that, do all of this work in an unprivileged role account.

  • thank you for answer. "ssh -i ~/place/where/the/key/lives -l username server restricted-command" But it asks passhphare, I want to avoid that, so thats why I use expect - to feed key passphrase to agent. May I trouble you for write how can I fix my script to start ssh-agent and prevent it from ceasing to feed passhphrase with "expect"? – rGA145 Aug 21 '16 at 21:55
  • Remove the passphrase from the key. You will then have to deal with no agent, no expect, and no passphrase. As I explained in the answer, the security of your key is already low anyway since you store its passphrase in the clear in a script. – Celada Aug 21 '16 at 21:59
  • But if I still want to use key with passphrase (and give it to agent via expect) - what shall I fix in my script? – rGA145 Aug 21 '16 at 22:16
  • I do not recommend that you do that. I recommend that you remove the passphrase from the script instead (since the security is equivalent). – Celada Aug 21 '16 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.