How to use ssh-agent for offering host specific keys from ~/.ssh/config file and manage the passphrases?

Question

I configured different hosts and keys for them in ~/.ssh/config file. But, to manage the passphrases of different keys, I seek help from ssh-agent by adding the keys to it, via ssh-add command. Now when I ssh my hosts, the agent offers all the keys it has one-by-one.

I searched how to restrict this behavior of ssh-agent and, used

IdentitiesOnly yes

in the config file for all hosts.

I successfully restricted the ssh-agent from offering the keys it has, by doing so, but the ssh-agent is no more managing the pass-phrases and I have to enter pass-phrase every time I ssh.

Is there a way to render only the key for the specific host I am ssh - ing (reading from the ~/.ssh/config file) and manage the passphrase too?

Answer 1

The issue can be resolved by doing the following:

1. Edit your client's ~/.ssh/config file such that the host entry has the following:

   Host fooName
       Hostname foo.name.tld
       User usrname
       IdentityFile ~/.ssh/fooName.pub
       IdentitiesOnly yes
   

   Note that the IdentityFile directive refers to the public key and not the private key file.

2. Add the relevant private key to ssh-agent using ssh-add. You should be prompted for a password at this time.

Answer 2

You can specify a public key via IdentityFile and if the private side is loaded in ssh-agent it will be used. Otherwise it will be treated as a private key, and likely generate an error about an unprotected private key file.

1. Ensure ssh-agent is running
2. Add your identity to the agent with ssh-add ~/.ssh/id_rsa
   • Respond to password challenge, if prompted
3. Add your identity's public key to ~/ssh/config, e.g.:

Host *
  IdentityFile ~/.ssh/id_rsa.pub   # Public key, SSH will consult ssh-agent
  IdentitiesOnly yes

Why would you want to do this?

It is best practice to encrypt private keys but it is inconvenient to have to respond to a password challenge every time you use your key. ssh-agent provides a means to cache decrypted keys, so you only have to respond to the password challenge to decrypt them occasionally.

But this creates a new problem: some hosts limit how many authentication errors they'll tolerate before closing the connection. If your ssh-agent has a lot of keys then you may hit this problem, which manifests as "Too many authentication errors".

To avoid this you can specify IdentityFile for a given host, and only that identity will be used. This neatly avoids "Too many authentication errors", but now you have to respond to the password challenge every time the key is used, essentially bypassing ssh-agent and the convenient caching mechanism!

If you know the identity (private key) is present in ssh-agent, you can get ssh to use it by specifying the public portion of the key, which is sufficient to locate which private key you are referring to without accessing it directly.

You can add/modify/remove passwords from private keys using ssh-keygen -p.

About ssh-agent

ssh-agent never provides the decrypted key to any process. Instead processes like ssh send the cryptographic challenge they've received to ssh-agent, which returns a challenge response. This keeps your private keys secure, but also allows ssh-agent to be tunnelled, so remote system can access your identities (so long as you remain connected). See man ssh_config and ForwardAgent.

Troubleshooting

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/Users/meermanr/.ssh/id_rsa.pub' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/Users/meermanr/.ssh/id_rsa.pub": bad permissions

This implies that ssh-agent is not running, or does not have the associated identity loaded. Check which identities are loaded with ssh-add -l, e.g.:

# ssh-add -l
The agent has no identities

Load the private key of the identity with ssh-add ~/.ssh/id_rsa:

# ssh-add /Users/meermanr/.ssh/id_rsa
Enter passphrase for /Users/meermanr/.ssh/id_rsa
Identity added: /Users/meermanr/.ssh/id_rsa (/Users/meermanr/.ssh/id_rsa)

Check:

# ssh-add -l
4096 SHA256:2Mn+jr5imURFStSWVaDHXhhx+6cyXXBoNjOfPLy2thQ /Users/meermanr/.ssh/id_rsa (RSA)

Try again.