6

Suppose I need to SSH into many systems and run a simple command on each. The problem is that I do not want to have to enter my password 50 times in a row to accomplish this. So I figure I will use RSA keys without a passphrase temporarily. My question is, is this standard practice to temporarily set your private key file to not have a passphrase for the purposes of running a non interactive script, at which point you would then set a very secure passphrase by way of ssh-keygen -p command? Is there another way to accomplish this?

14

My question is, is this standard practice to temporarily set your private key file to not have a passphrase for the purposes of running a non interactive script [...]

No. The standard practice is to use a key agent to store your passphrase. When using a key agent, you can enter your passphrase once, when adding the key to the agent, and afterwards the agent will provide it to ssh connections you initiate.

There are many tutorials on this. Here's the basic usage in a nutshell:

# start ssh key agent and set environment variables
eval $(ssh-agent)

# add your private key
ssh-add

How it works, in a nutshell:

  • The ssh-agent command outputs some environment variables you need to set, so that programs (like ssh, scp, rsync and others) find the ssh-agent process. This output is ready to execute, to actually set the variables, and this is the purpose of the eval statement.

  • ssh-add finds the ssh-agent process thanks to the configured environment variables, and adds the private key at the default location in your ~/.ssh directory. At this point you will be asked to enter the passphrase.

After this, you will be able to ssh, scp, and others to any server where your key is authorized, without having to re-enter the passphrase.

  • Thanks. I think I have actually heard of this before but have not encountered it in practice. Does OpenSSH come with a key agent? Or is there a recommended package for standard Linux distributions? – Timothy Pulliam Dec 22 '16 at 19:36
  • 1
    Hi @TimothyPulliam, I added a bit more explanation. Yes, ssh-agent comes with OpenSSH, it's standard. – janos Dec 22 '16 at 19:39
  • Thanks! You gave me the answer I was looking for. I will certainly learn all I can about these commands. – Timothy Pulliam Dec 22 '16 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.