1

I'm writing a script to creating a set off ssh keys and uploading them to the known hosts. This is for when you want keys per device.

I included an option to upload the new key to the host after its creation. However, bash seems to have lost my session or something, because it prompts me for a password, when it should have just sent the item since I have the keys loaded in a key manager, or as a fall back, prompt me for the password of the keyfile specified in the ssh config.

Here's the relevant parts of the script:

for host in "${hosts[@]}"
do
  keyfile=$(printf "%s_keys/%s_%s_%s.id_ed25519" "$system" "$system" "$email" "$host")
  ssh-keygen -t ed25519 -C $(printf "%s_%s" "$email" "$system") -P "$pw1" -f "$keyfile"
  read -r -p "ssh new key to host $host? [y/n] " response
  if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]
  then
    cat $keyfile.pub | ssh "$host" 'cat >> .ssh/authorized_keys'
  fi
done

So when I ran the script, I got this:

The key fingerprint is:
SHA256:n8FWwe+TaHbWKwWVzCdIbAcfFnPTh8J0pukzuv9J4pQ a_b
The key's randomart image is:
+--[ED25519 256]--+
...
+----[SHA256]-----+
ssh new key to host [email protected]? [y/n] y
u[email protected]'s password:
Permission denied, please try again.

However:

$ ssh myhost.com

You have new mail.
Last login: Sun Oct 30 03:28:07 2016 from 65.60.221.155
[myhost.com ~]

As a test, I wrote this more simplified script, and it fired without a hitch:

$ cat test.bash
#!/bin/bash
echo test | ssh myhost.com 'cat >> test.txt'
$ ./test.bash

$ ssh myhost.com

You have new mail.
Last login: Sun Oct 30 03:33:25 2016 from 65.60.221.155
[myhost.com ~] cat test.txt
test

What did I do in my longer script that caused it to forget my ssh information?

5
  • 1
    do you have password based logins allowed on your remote servers? also why aren't you using something like ssh-copy-id -i ~/.ssh/<pub_key> user@server wouldn't that make it easier? Oct 30, 2016 at 5:26
  • 1
    Are you running the script as a same user? Turn on the verbose log to see more (-vvv).
    – Jakuje
    Oct 30, 2016 at 8:04
  • You run ssh myhost.com on the command line but ssh [email protected] in the script. You may be attempting to log in as a different user. Oct 30, 2016 at 14:06
  • cat >> test and cat >> somedirthatmaynotexist/test are two very different things
    – thrig
    Oct 30, 2016 at 15:35
  • @Gilles I'm not doing that; it's because the script isn't using my .ssh/config and defaulting to user/pass login. What you're referring to is the output, not the command in the script. The script has cat $keyfile.pub | ssh "$host" 'cat >> .ssh/authorized_keys'
    – user394
    Oct 31, 2016 at 2:22

1 Answer 1

2

OK, I feel a little dumb for having made this mistake, but a little clever for having figured it out-- thanks to @Jajuke 's suggestion to do a very, very verbose ssh.

In my ssh config, I have abbreviations set up for my hosts, for instance:

Host myhost
  HostName myhost.com
  User username

And on the shell, I just do ssh myhost and everything just works.

However, in my script, I parse the hostnames from .ssh/known_hosts, which has the full hostname :P In my ssh config, I didn't have anything set up for myhost.com; just myhost. So of course, ssh fell back to password authentication.

My solution was to update my ssh config to include the full hostname next to my alias:

Host myhost myhost.com
  HostName myhost.com
  User username

And it just works again!

Hopefully this will save someone from similar puzzlement.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .