How can I get computer to remember SSH key passphrase between reboots?

Question

I've found various solutions to cache SSH key passphrases using such methods as ssh-agent, keychain, gpg-agent and so on. They all seem to cache it per-login or per-session, so that every time you reboot your computer, you will have to re-enter your passphrase to SSH (but subsequent SSHs won't ask for the password until you reboot).

I don't want the cache to clear on reboot. I want to enter the passphrase once, and never be asked for it again, even if I turn off my computer. How can I do this?

In case it matters, I'm on Manjaro.

Answer 1

I agree with @terdon, having computer remember pass-phrase is equivalent to having no pass-phrase.

However there are alternatives. Configure PAM to use ssh pass-phrase instead of password, to login. This way you only have to type in one secret, so more convenient.

In addition: Configure ssh to use multi-round encryption, so that it takes about a second to decrypt your key, this will make you shorter password more secure. Use a good easy to type, easy to remember, hard to guess password.

Answer 2

The Gnome keyring can store an SSH passphrase and serve as an SSH agent. Make sure that you are running gnome-keyring with the ssh component; the environment variable SSH_AUTH_SOCK should point to gnome-keyring and not to ssh-agent. The keyring will contain the SSH key, so it doesn't need to be re-read from the key file in ~/.ssh. The keyring is persistent, so adding a key to it survives a reboot. Once you unlock the Gnome keyring, all of its contents including the SSH key are available to applications.

Answer 3

I came across this question at the same time as this similar question on Ask Ubuntu, and the fix I posted there may be applicable here, as well. (I got the answer from here.)

The main thing is that this fix is only applicable if you are using Seahorse, AKA Passwords and Keys, the GUI frontend for GNOME Keyring. Seahorse is enabled by default on Ubuntu, among other Linux distros. If you're using Seahorse, you can call the command-line executable ssh-askpass, which will prompt you for the passphrase for a given SSH key and then save that passphrase in GNOME Keyring. (There is a similar process for macOS, which I will describe below the process for Seahorse.)

EDIT: it seems like maybe the more important thing was going into the Seahorse GUI, clicking OpenSSH Keys, right-clicking on the key in question, selecting "Configure Key for Secure Shell...", and adding each of the servers and usernames to use the key with. I had done this earlier today (before running ssh-askpass) but completely forgotten. Strangely, this part of the process doesn't seem to prompt for a password.

To save the passphrase for an SSH key in Seahorse, use the following command:

$ <seahorse_ssh-askpass> <key_path>

You want to make sure you use the ssh-askpass associated with Seahorse, and it might not be in the same place on every system, but in my case (Ubuntu 20.10) it was the following:

$ /usr/libexec/seahorse/ssh-askpass <key_path>

If this executable location doesn't work on your system, you can try the following:

$ locate ssh-askpass | grep seahorse

Which will list all files and directories containing ssh-askpass in the name and seahorse in the path. (You may need to install and set up mlocate on your system before you can run this command.)

The most common path for an SSH key is ~/.ssh/id_rsa, but you can check in the Seahorse GUI to see if it's something else. In my case, I used the following command:

$ /usr/libexec/seahorse/ssh-askpass ~/.ssh/alpha_rsa

If you execute the command successfully, it will pop up a dialogue box listing the name of the SSH key and asking for your password. In my case I got a Vala error saying it couldn't grab the keyboard, and the password I entered got printed to the terminal, but this command seems to have succeeded in making that particular SSH key unlock automatically when my GNOME Keyring is unlocked.

As an aside, if you don't want this to be a glaring security hole, it's worth making sure that your GNOME Keyring doesn't automatically unlock without a passphrase when you turn on your computer. In my case, I have a YubiKey with a passphrase that I have to enter before Linux can even boot. You will also want to make sure that your computer locks automatically when you're not using it. But assuming you have to enter a passphrase to boot up or log in and to unlock your computer (i.e. wake it from sleep), any SSH passphrase saved in your GNOME Keyring should be as secure as anything else in your GNOME Keyring.

If you are on macOS, you can use a similar process to save SSH-key passphrases in the macOS Keychain, which is encrypted with a user's login password.

Assuming you already have your SSH keys set up in ~/.ssh, you can edit the SSH config file by entering the following into Terminal:

% nano ~/.ssh/config

At the top of the file, paste the following:

Host *
  AddKeysToAgent yes
  UseKeychain yes

There is a lot more you can do with the SSH config file, but I got this particular configuration from this blog post by Derik Ramirez. (Note that while AddKeysToAgent is applicable to platforms other than macOS, UseKeyChain is not.)

Type control-o to save your SSH config, then type control-x to exit nano and return to the shell prompt. You should be able to use your new SSH config immediately, and the next time you enter an SSH-key passphrase, it should save to your Login keychain (so you won't have to enter it again after that).