0

I'm writing a script to creating a set off ssh keys and uploading them to the known hosts. This is for when you want keys per device.

I included an option to upload the new key to the host after its creation. However, bash seems to have lost my session or something, because it prompts me for a password, when it should have just sent the item since I have the keys loaded in a key manager, or as a fall back, prompt me for the password of the keyfile specified in the ssh config.

Here's the relevant parts of the script:

for host in "${hosts[@]}"
do
  keyfile=$(printf "%s_keys/%s_%s_%s.id_ed25519" "$system" "$system" "$email" "$host")
  ssh-keygen -t ed25519 -C $(printf "%s_%s" "$email" "$system") -P "$pw1" -f "$keyfile"
  read -r -p "ssh new key to host $host? [y/n] " response
  if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]
  then
    cat $keyfile.pub | ssh "$host" 'cat >> .ssh/authorized_keys'
  fi
done

So when I ran the script, I got this:

The key fingerprint is:
SHA256:n8FWwe+TaHbWKwWVzCdIbAcfFnPTh8J0pukzuv9J4pQ a_b
The key's randomart image is:
+--[ED25519 256]--+
...
+----[SHA256]-----+
ssh new key to host user@myhost.com? [y/n] y
user@myhost.com's password:
Permission denied, please try again.

However:

$ ssh myhost.com

You have new mail.
Last login: Sun Oct 30 03:28:07 2016 from 65.60.221.155
[myhost.com ~]

As a test, I wrote this more simplified script, and it fired without a hitch:

$ cat test.bash
#!/bin/bash
echo test | ssh myhost.com 'cat >> test.txt'
$ ./test.bash

$ ssh myhost.com

You have new mail.
Last login: Sun Oct 30 03:33:25 2016 from 65.60.221.155
[myhost.com ~] cat test.txt
test

What did I do in my longer script that caused it to forget my ssh information?

  • 1
    do you have password based logins allowed on your remote servers? also why aren't you using something like ssh-copy-id -i ~/.ssh/<pub_key> user@server wouldn't that make it easier? – the_velour_fog Oct 30 '16 at 5:26
  • 1
    Are you running the script as a same user? Turn on the verbose log to see more (-vvv). – Jakuje Oct 30 '16 at 8:04
  • You run ssh myhost.com on the command line but ssh user@myhost.com in the script. You may be attempting to log in as a different user. – Gilles Oct 30 '16 at 14:06
  • cat >> test and cat >> somedirthatmaynotexist/test are two very different things – thrig Oct 30 '16 at 15:35
  • @Gilles I'm not doing that; it's because the script isn't using my .ssh/config and defaulting to user/pass login. What you're referring to is the output, not the command in the script. The script has cat $keyfile.pub | ssh "$host" 'cat >> .ssh/authorized_keys' – user394 Oct 31 '16 at 2:22
0

OK, I feel a little dumb for having made this mistake, but a little clever for having figured it out-- thanks to @Jajuke 's suggestion to do a very, very verbose ssh.

In my ssh config, I have abbreviations set up for my hosts, for instance:

Host myhost
  HostName myhost.com
  User username

And on the shell, I just do ssh myhost and everything just works.

However, in my script, I parse the hostnames from .ssh/known_hosts, which has the full hostname :P In my ssh config, I didn't have anything set up for myhost.com; just myhost. So of course, ssh fell back to password authentication.

My solution was to update my ssh config to include the full hostname next to my alias:

Host myhost myhost.com
  HostName myhost.com
  User username

And it just works again!

Hopefully this will save someone from similar puzzlement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.