How to pass to ssh the key stored in a shell environment variable?

Question

Presumably ssh tries to access the fd several times, but the fd is destroyed after it has been read the very first time:

# ssh -i <(echo $KEY) user@example.com
Warning: Identity file /dev/fd/11 not accessible: Bad file descriptor.
user@example.com: Permission denied (publickey).

Is there any other way without writing/removing temporary file?

Answer 1

export MYKEY=`cat key.pem`
ssh-add - <<< "$MYKEY"
ssh ec2-user@100.123.111.63

Answer 2

tl;dr No, but see The XY Problem.

$ strace -f ssh -i <(cat ~/.ssh/id_rsa) user@server echo test
...
close(63)
...
newfstatat(AT_FDCWD, "/dev/fd/63", 0x7ffc4f1d0c60, 0) = -1 ENOENT (No such file or directory)
write(2, "Warning: Identity file /dev/fd/6"..., 77Warning: Identity file /dev/fd/63 not accessible: No such file or directory.) = 77

So for some reason at the beginning ssh closes the fd. Maybe it closes all but the standard descriptors.

In any case, your assumption is wrong:

Presumably ssh tries to access the fd several times, but the fd is destroyed after it has been read the very first time

There's just one syscall dealing with the fd before trying to stat it: close(63). And yep, after that it gets destroyed.

Answer 3

As an alternative, if writing the key into a temporary secure file that is guaranteed to be cleaned up (sans a kill -9) is acceptable to you. I use this Bash helper function to wrap over ssh, scp, and sftp allowing me to pass the key as the first argument:

with-ssh-key() (
    # Bash wrapper for OpenSSH CLI tools (ssh, scp, sftp, or any that accept
    # the `-i /path/to/keyfile` option) that allows for passing an SSH private
    # key as the first parameter rather than via a persistent identity file.
    # This is something that is not possible with ssh tools by default.
    #
    # This command is useful when storing the key in an environment variable
    # that is set in some secure way, such as set via secrets mastered in the
    # AWS Parameter Store, or as the result another command in a subshell.
    #
    # The "OPENSSH PRIVATE KEY" lines at the beginning and end of the passed
    # key string will be added if they are not on already present.
    #
    # Usage: with-ssh-key {ssh | scp | sftp} KEY ADDITIONAL_ARGS...
    #
    # Examples:
    #   key="b3blbnnzaC1rZXktdjEAAAAABG5vbmUAAAA[etc...]"
    #   with-ssh-key "$key" ssh myserver echo Hello-from-myserver
    #   with-ssh-key "$key" scp myserver:file.txt ./
    #   echo get file.txt | with-ssh-key "$key" sftp myserver
    #
    # A note regarding zsh: this wrapper is not necessary in zsh because zsh
    # has the extremely convenient `=(cmd)` syntax which will create a real
    # on-disk tempfile and clean it up immediately after the calling command
    # exits. Thus you can easily do something like this in zsh to accomplish
    # the same effect as this wrapper:
    #
    #   ssh -i =(echo "$key") ...
    #
    # Or, if you need to add the header/footer lines:
    # 
    #   ssh -i =(echo "-----BEGIN OPENSSH PRIVATE KEY-----\n$(echo "$key")\n-----END OPENSSH PRIVATE KEY-----")
    set -euo pipefail
    key="$1"; shift
    cmd="$1"; shift
    tempkeyfile=$(mktemp)
    chmod 600 "$tempkeyfile" # ensure file is locked down
    trap "rm \"$tempkeyfile\"" 0 2 3 15 # ensure tempfile cleanup in event of various signals
    [[ $key =~ "BEGIN OPENSSH PRIVATE KEY" ]] || echo "-----BEGIN OPENSSH PRIVATE KEY-----" >> $tempkeyfile
    echo "$key" >> $tempkeyfile
    [[ $key =~ "END OPENSSH PRIVATE KEY" ]] || echo "-----END OPENSSH PRIVATE KEY-----" >> $tempkeyfile
    $cmd -i "$tempkeyfile" "$@"
)