5

I configured different hosts and keys for them in ~/.ssh/config file. But, to manage the passphrases of different keys, I seek help from ssh-agent by adding the keys to it, via ssh-add command. Now when I ssh my hosts, the agent offers all the keys it has one-by-one.

I searched how to restrict this behavior of ssh-agent and, used

IdentitiesOnly yes

in the config file for all hosts.

I successfully restricted the ssh-agent from offering the keys it has, by doing so, but the ssh-agent is no more managing the pass-phrases and I have to enter pass-phrase every time I ssh.

Is there a way to render only the key for the specific host I am ssh - ing (reading from the ~/.ssh/config file) and manage the passphrase too?

  • What OS is your client running on? I asked because, e.g., on Fedora GnomeKeyring (wiki.gnome.org/Projects/GnomeKeyring/Ssh) pretends to be ssh-agent and mucks things up... bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/771272 , It doesn't support Ed25519 or NIST ECDSA types. In some cases, it's crashed when loading those types. Also, did you specify IdentityFile path/to/id_rsa in your ~/.ssh/config? – Liczyrzepa Feb 7 '17 at 3:44
  • Which distribution are you using? I definately cannot confirm this on Debian 18.04 running KDE. Specifying both IdentityFile and IdentitiesOnly yes, and having the key loaded in ssh-agent with ssh-add, ssh'ing into a machine doesn't prompt for the key password. It seems to me IdentitiesOnly yes doesn't rely on a running ssh-agent, but when there is one, it will happily use it for the password. It will not iterate over the passwords. – Multisync Apr 4 at 9:56
3

The issue can be resolved by doing the following:

  1. Edit your client's ~/.ssh/config file such that the host entry has the following:

    Host fooName
        Hostname foo.name.tld
        User usrname
        IdentityFile ~/.ssh/fooName.pub
        IdentitiesOnly yes
    

    Note that the IdentityFile directive refers to the public key and not the private key file.

  2. Add the relevant private key to ssh-agent using ssh-add. You should be prompted for a password at this time.

| improve this answer | |
  • Is this an undocumented feature of IdentityFile??? I tried this and it works, but I can find it documented anywhere. – Drew Beres Nov 5 '19 at 23:01
  • On Debian 18.04 with KDE, this emits the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for '/home/manuel/.ssh/id_test.pub' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. Load key "/home/user/.ssh/id_test.ed25519.pub": bad permissions – Multisync Apr 4 at 9:57
  • After setting permissions to 600 (which there is no need for a public key), it says Load key "/home/manuel/.ssh/id_test.ed25519.pub": invalid format – Multisync Apr 4 at 10:00
  • @Multisync Are you adding the private key to sshagent? The filename in your last comment ends with .pub – chb Apr 4 at 14:06
  • @chb No, I was adding the public key. This was explicitely stated in this answer we are commenting: "Note that the IdentityFile directive refers to the public key and not the private key file." I think this is wrong, the private key must be used. – Multisync Apr 5 at 18:16
1

You can specify a public key via IdentityFile and if the private side is loaded in ssh-agent it will be used. Otherwise it will be treated as a private key, and likely generate an error about an unprotected private key file.

  1. Ensure ssh-agent is running
  2. Add your identity to the agent with ssh-add ~/.ssh/id_rsa
    • Respond to password challenge, if prompted
  3. Add your identity's public key to ~/ssh/config, e.g.:
Host *
  IdentityFile ~/.ssh/id_rsa.pub   # Public key, SSH will consult ssh-agent
  IdentitiesOnly yes

Why would you want to do this?

It is best practice to encrypt private keys but it is inconvenient to have to respond to a password challenge every time you use your key. ssh-agent provides a means to cache decrypted keys, so you only have to respond to the password challenge to decrypt them occasionally.

But this creates a new problem: some hosts limit how many authentication errors they'll tolerate before closing the connection. If your ssh-agent has a lot of keys then you may hit this problem, which manifests as "Too many authentication errors".

To avoid this you can specify IdentityFile for a given host, and only that identity will be used. This neatly avoids "Too many authentication errors", but now you have to respond to the password challenge every time the key is used, essentially bypassing ssh-agent and the convenient caching mechanism!

If you know the identity (private key) is present in ssh-agent, you can get ssh to use it by specifying the public portion of the key, which is sufficient to locate which private key you are referring to without accessing it directly.

You can add/modify/remove passwords from private keys using ssh-keygen -p.

About ssh-agent

ssh-agent never provides the decrypted key to any process. Instead processes like ssh send the cryptographic challenge they've received to ssh-agent, which returns a challenge response. This keeps your private keys secure, but also allows ssh-agent to be tunnelled, so remote system can access your identities (so long as you remain connected). See man ssh_config and ForwardAgent.

Troubleshooting

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/Users/meermanr/.ssh/id_rsa.pub' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/Users/meermanr/.ssh/id_rsa.pub": bad permissions

This implies that ssh-agent is not running, or does not have the associated identity loaded. Check which identities are loaded with ssh-add -l, e.g.:

# ssh-add -l
The agent has no identities

Load the private key of the identity with ssh-add ~/.ssh/id_rsa:

# ssh-add /Users/meermanr/.ssh/id_rsa
Enter passphrase for /Users/meermanr/.ssh/id_rsa
Identity added: /Users/meermanr/.ssh/id_rsa (/Users/meermanr/.ssh/id_rsa)

Check:

# ssh-add -l
4096 SHA256:2Mn+jr5imURFStSWVaDHXhhx+6cyXXBoNjOfPLy2thQ /Users/meermanr/.ssh/id_rsa (RSA)

Try again.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.