3

I've found various solutions to cache SSH key passphrases using such methods as ssh-agent, keychain, gpg-agent and so on. They all seem to cache it per-login or per-session, so that every time you reboot your computer, you will have to re-enter your passphrase to SSH (but subsequent SSHs won't ask for the password until you reboot).

I don't want the cache to clear on reboot. I want to enter the passphrase once, and never be asked for it again, even if I turn off my computer. How can I do this?

In case it matters, I'm on Manjaro.

| improve this question | | | | |
  • 5
    In that case why don't you just use an empty passphrase? It makes no difference in terms of security (no difference from having it cached for ever, I mean). – terdon♦ Apr 29 '17 at 23:15
  • 1
    Use something like gnome-keyring-daemon to act as ssh agent and store the passphrase. – Patrick Apr 30 '17 at 0:11
  • You first say "per-login", but then go on to mentioning rebooting the machine. Those aren't the same. You can run a persistent ssh-agent and have the passphrase cached over multiple logins. That would still have the benefit of keeping the key encrypted on-disk. To have the passphrase cached over reboots, would require saving it on disk, and then you might as well keep the key unencrypted (like terdon said). – ilkkachu Apr 30 '17 at 9:35
  • 1
    @terdon Wrong, it does make a difference. Not a huge one, but it does. An unencrypted passphrase would be immediately revealed if an attacker gets hold of the disk contents, e.g. by stealing the computer or by gaining access to a backup. – Gilles 'SO- stop being evil' Apr 30 '17 at 21:47
2

The Gnome keyring can store an SSH passphrase and serve as an SSH agent. Make sure that you are running gnome-keyring with the ssh component; the environment variable SSH_AUTH_SOCK should point to gnome-keyring and not to ssh-agent. The keyring will contain the SSH key, so it doesn't need to be re-read from the key file in ~/.ssh. The keyring is persistent, so adding a key to it survives a reboot. Once you unlock the Gnome keyring, all of its contents including the SSH key are available to applications.

| improve this answer | | | | |
  • I think gnome keyring can be unlocked using PAM, so at login. But insure that you password is strong enough. – ctrl-alt-delor May 1 '17 at 8:54
  • @richard Yes. Usually the gnome keyring contains more important passwords than the ones on the SSH keys, so you definitely need to ensure that your login password is strong enough if you use it to unlock the keyring. – Gilles 'SO- stop being evil' May 1 '17 at 10:02
  • Can you explain what commands exactly I am supposed to type to do what you say? I have tried using Seahorse but that doesn't support some key types. – Bagalaw May 4 '17 at 0:49
5

I agree with @terdon, having computer remember pass-phrase is equivalent to having no pass-phrase.

However there are alternatives. Configure PAM to use ssh pass-phrase instead of password, to login. This way you only have to type in one secret, so more convenient.

In addition: Configure ssh to use multi-round encryption, so that it takes about a second to decrypt your key, this will make you shorter password more secure. Use a good easy to type, easy to remember, hard to guess password.

| improve this answer | | | | |
  • 3
    I like the PAM idea. Could you explain how to do that? – terdon♦ Apr 29 '17 at 23:40
  • 1
    “having computer remember pass-phrase is equivalent to having no pass-phrase.” No, it makes a difference if someone gets hold of the disk contents (by stealing the computer while it's off, or by gaining access to an unencrypted backup). – Gilles 'SO- stop being evil' Apr 30 '17 at 21:46
  • @gilles only if files are stored separately. – ctrl-alt-delor May 1 '17 at 8:52
  • I agree with @Gilles. – Bagalaw May 4 '17 at 0:48
  • @Bagalow Then send your encrypted ssh keys to we with the remembered key (it will be safe with me). Ask when computer is off, where is the pass-phrase stored? – ctrl-alt-delor May 4 '17 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.