3

I've found various solutions to cache SSH key passphrases using such methods as ssh-agent, keychain, gpg-agent and so on. They all seem to cache it per-login or per-session, so that every time you reboot your computer, you will have to re-enter your passphrase to SSH (but subsequent SSHs won't ask for the password until you reboot).

I don't want the cache to clear on reboot. I want to enter the passphrase once, and never be asked for it again, even if I turn off my computer. How can I do this?

In case it matters, I'm on Manjaro.

Improve this question
4
  • 5
    In that case why don't you just use an empty passphrase? It makes no difference in terms of security (no difference from having it cached for ever, I mean). – terdon♦ Apr 29 '17 at 23:15
  • 1
    Use something like gnome-keyring-daemon to act as ssh agent and store the passphrase. – phemmer Apr 30 '17 at 0:11
  • You first say "per-login", but then go on to mentioning rebooting the machine. Those aren't the same. You can run a persistent ssh-agent and have the passphrase cached over multiple logins. That would still have the benefit of keeping the key encrypted on-disk. To have the passphrase cached over reboots, would require saving it on disk, and then you might as well keep the key unencrypted (like terdon said). – ilkkachu Apr 30 '17 at 9:35
  • 1
    @terdon Wrong, it does make a difference. Not a huge one, but it does. An unencrypted passphrase would be immediately revealed if an attacker gets hold of the disk contents, e.g. by stealing the computer or by gaining access to a backup. – Gilles 'SO- stop being evil' Apr 30 '17 at 21:47
3

The Gnome keyring can store an SSH passphrase and serve as an SSH agent. Make sure that you are running gnome-keyring with the ssh component; the environment variable SSH_AUTH_SOCK should point to gnome-keyring and not to ssh-agent. The keyring will contain the SSH key, so it doesn't need to be re-read from the key file in ~/.ssh. The keyring is persistent, so adding a key to it survives a reboot. Once you unlock the Gnome keyring, all of its contents including the SSH key are available to applications.

Improve this answer
3
  • I think gnome keyring can be unlocked using PAM, so at login. But insure that you password is strong enough. – ctrl-alt-delor May 1 '17 at 8:54
  • @richard Yes. Usually the gnome keyring contains more important passwords than the ones on the SSH keys, so you definitely need to ensure that your login password is strong enough if you use it to unlock the keyring. – Gilles 'SO- stop being evil' May 1 '17 at 10:02
  • Can you explain what commands exactly I am supposed to type to do what you say? I have tried using Seahorse but that doesn't support some key types. – Bagalaw May 4 '17 at 0:49
5

I agree with @terdon, having computer remember pass-phrase is equivalent to having no pass-phrase.

However there are alternatives. Configure PAM to use ssh pass-phrase instead of password, to login. This way you only have to type in one secret, so more convenient.

In addition: Configure ssh to use multi-round encryption, so that it takes about a second to decrypt your key, this will make you shorter password more secure. Use a good easy to type, easy to remember, hard to guess password.

Improve this answer
5
  • 3
    I like the PAM idea. Could you explain how to do that? – terdon♦ Apr 29 '17 at 23:40
  • 1
    “having computer remember pass-phrase is equivalent to having no pass-phrase.” No, it makes a difference if someone gets hold of the disk contents (by stealing the computer while it's off, or by gaining access to an unencrypted backup). – Gilles 'SO- stop being evil' Apr 30 '17 at 21:46
  • @gilles only if files are stored separately. – ctrl-alt-delor May 1 '17 at 8:52
  • I agree with @Gilles. – Bagalaw May 4 '17 at 0:48
  • @Bagalow Then send your encrypted ssh keys to we with the remembered key (it will be safe with me). Ask when computer is off, where is the pass-phrase stored? – ctrl-alt-delor May 4 '17 at 16:21
0

I came across this question at the same time as this similar question on Ask Ubuntu, and the fix I posted there may be applicable here, as well. (I got the answer from here.)

The main thing is that this fix is only applicable if you are using Seahorse, AKA Passwords and Keys, the GUI frontend for GNOME Keyring. Seahorse is enabled by default on Ubuntu, among other Linux distros. If you're using Seahorse, you can call the command-line executable ssh-askpass, which will prompt you for the passphrase for a given SSH key and then save that passphrase in GNOME Keyring. (There is a similar process for macOS, which I will describe below the process for Seahorse.)

EDIT: it seems like maybe the more important thing was going into the Seahorse GUI, clicking OpenSSH Keys, right-clicking on the key in question, selecting "Configure Key for Secure Shell...", and adding each of the servers and usernames to use the key with. I had done this earlier today (before running ssh-askpass) but completely forgotten. Strangely, this part of the process doesn't seem to prompt for a password.

To save the passphrase for an SSH key in Seahorse, use the following command:

$ <seahorse_ssh-askpass> <key_path>

You want to make sure you use the ssh-askpass associated with Seahorse, and it might not be in the same place on every system, but in my case (Ubuntu 20.10) it was the following:

$ /usr/libexec/seahorse/ssh-askpass <key_path>

If this executable location doesn't work on your system, you can try the following:

$ locate ssh-askpass | grep seahorse

Which will list all files and directories containing ssh-askpass in the name and seahorse in the path. (You may need to install and set up mlocate on your system before you can run this command.)

The most common path for an SSH key is ~/.ssh/id_rsa, but you can check in the Seahorse GUI to see if it's something else. In my case, I used the following command:

$ /usr/libexec/seahorse/ssh-askpass ~/.ssh/alpha_rsa

If you execute the command successfully, it will pop up a dialogue box listing the name of the SSH key and asking for your password. In my case I got a Vala error saying it couldn't grab the keyboard, and the password I entered got printed to the terminal, but this command seems to have succeeded in making that particular SSH key unlock automatically when my GNOME Keyring is unlocked.

As an aside, if you don't want this to be a glaring security hole, it's worth making sure that your GNOME Keyring doesn't automatically unlock without a passphrase when you turn on your computer. In my case, I have a YubiKey with a passphrase that I have to enter before Linux can even boot. You will also want to make sure that your computer locks automatically when you're not using it. But assuming you have to enter a passphrase to boot up or log in and to unlock your computer (i.e. wake it from sleep), any SSH passphrase saved in your GNOME Keyring should be as secure as anything else in your GNOME Keyring.

If you are on macOS, you can use a similar process to save SSH-key passphrases in the macOS Keychain, which is encrypted with a user's login password.

Assuming you already have your SSH keys set up in ~/.ssh, you can edit the SSH config file by entering the following into Terminal:

% nano ~/.ssh/config

At the top of the file, paste the following:

Host *
  AddKeysToAgent yes
  UseKeychain yes

There is a lot more you can do with the SSH config file, but I got this particular configuration from this blog post by Derik Ramirez. (Note that while AddKeysToAgent is applicable to platforms other than macOS, UseKeyChain is not.)

Type control-o to save your SSH config, then type control-x to exit nano and return to the shell prompt. You should be able to use your new SSH config immediately, and the next time you enter an SSH-key passphrase, it should save to your Login keychain (so you won't have to enter it again after that).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.