3

I have an SSH key that I use almost every day and I recently noticed that I haven't had to unlock it in a long while. I don't always shut down my computer and so it is fairly common that ssh-agent is already running when I access a server. But I've now confirmed that actually I'm never being asked for a password.

I feel a little bit like I've lost my mind, because ...

  • ps aux | grep agent doesn't show ssh-agent running.
  • ssh-keygen -y asks for a password but the password I expect doesn't work.
  • ssh [email protected] connects immediately.

There's nothing especially sensitive at stake right now, though that's temporary.

What should I be looking for here? How is my key working without a passphrase, even after a restart? I'm assuming I did something here, but how can I figure out what I did?

Per the comments, I did run echo $SSH_AUTH_SOCK and I see /run/user/1000/keyring/ssh -- lsof /run/user/1000/keyring/ssh isn't returning anything, though, so I don't know what is opening it.

How do I ensure that my key isn't just hanging out unlocked?

7
  • 1
    There are other things which can act as an ssh agent. Do echo $SSH_AUTH_SOCK and you can see if you have one. An lsof on it will tell you what is providing it.
    – phemmer
    Commented Feb 16, 2018 at 3:57
  • I see /run/user/1000/keyring/ssh when I do that--but lsof | grep ssh isn't turning up anything.
    – Amanda
    Commented Feb 16, 2018 at 4:21
  • 4
    no grep, just lsof. Though judging from the path, I suspect it's gnome-keyring-daemon.
    – phemmer
    Commented Feb 16, 2018 at 4:23
  • Straight lsof gets me 11,000 lines though.
    – Amanda
    Commented Feb 16, 2018 at 4:34
  • lsof on the file. E.G. lsof /run/user/1000/keyring/ssh
    – phemmer
    Commented Feb 16, 2018 at 4:39

1 Answer 1

3

I had the same confusion and managed to discover what's going on.

First, I was wondering why ssh-agent was running on its own automatically, so I ran ps with the f flag to see what other process forked (spawned) ssh-agent:

ps auxf | grep ssh-agent -C3

The result was:

foobar      4478  0.0  0.0 602792  7748 ?        SLl  Jun07   0:01 /usr/bin/gnome-keyring-daemon --daemonize --login
foobar    576058  0.0  0.0   7492  4872 ?        S    01:24   0:00  \_ /usr/bin/ssh-agent -D -a /run/user/1000/keyring/.ssh

Then I researched the gnome-keyring-daemon (the process which had spawned ssh-agent) and saw the following wiki page:

https://wiki.gnome.org/Projects/GnomeKeyring/Ssh

Basically: GNOME Keyring Daemon is a permanent, per-user service, which loads a permanent per-user instance of SSH-Agent, which keeps your keys unlocked in memory. This means that you don't have to tediously type the passwords for your SSH keys every time you open another terminal window, because the SSH-Agent keeps all unlocked keys in memory throughout your entire session.

The SSH-Agent that it spawns also permanently monitors ~/.ssh (but not subfolders) for new key-files (any new file with an associated .pub file according to docs). This means that it automatically adds new keys to your SSH-Agent, without having to manually run ssh-add on the files. You can see this in action if you run ssh-add -l to list all keys before and after you put new files in the ~/.ssh folder. It will instantly show up, automatically.

The GNOME Keyring Daemon is installed and enabled by default on Fedora Workstation 36 (my operating system).

I am actually grateful, because it means I can enjoy password-protected ~/.ssh key files without having to CONSTANTLY type their password. If a malicious app steals my key files, they won't have the passwords, since those are securely stored in ssh-agent's memory.

It also means that I can use password-protected SSH keys for things that MUST run unattended in the background (such as scheduled Borg backup jobs). Thanks to how GNOME Keyring Daemon works, it will automatically decrypt the password-protected key without user intervention.

Basically, all your SSH keys are protected "at rest" (encrypted on disk). Without any of the downsides.

Whenever an SSH connection is attempted, GNOME Keyring Daemon handles it as follows:

  • If it's the first time that key is being used, or if the password is not stored in your keyring, then it presents this window, which asks you to manually unlock the key with its password:

key authentication

  • If you type the password and hit "Unlock", it will remain unlocked until you log out/reboot your machine. When you login to your computer next time, you will be asked for the SSH password as soon as you use that key again.

  • If you instead enable "Automatically unlock this key whenever I'm logged in", the password will be stored in your personal GNOME Keyring and will automatically unlock itself every time you login, which is brilliant if you need the key to be usable immediately without user intervention. And it's still safe, since the key is always encrypted on disk!

It is literally as perfect as it can be.

PS: There's another variation a lot of people talk about; funtoo's "keychain" project, but as of this writing it hasn't been updated since January 2018 (almost 5 years ago). I had been eyeing it since a lot of people talk about it, but it's very limited in comparison (only runs inside terminals via your ~/.bashrc instead of permanently running when you've logged in) and therefore can't handle things like backup tasks. Today's discovery was amazing, since I had no idea that GNOME already had the perfect and actively maintained/developed gnome-keyring-daemon service instead. I am grateful that I won't have to use funtoo's outdated keychain. Fedora has the GNOME service and therefore "just works" out of the box! That's awesome news for me! :)

Basically, today I learned how awesome gnome-keyring-daemon is!

If you truly want to disable it, the wiki page I linked to has instructions. But I don't see why, since it correctly uses the official ssh-agent daemon, which securely keeps your keys in memory. A lot of people manually struggle with starting an ssh-agent and keeping 1 shared instance of it alive. GNOME's Keyring Daemon gives you that effortlessly without any need for configuration or hassle. It's great! It lets you password-protect all your keys on disk for extra security, without any of the hassle.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .