Skip password prompt and pass password to ssh-add in script

Question

I'm trying to write a script that automatically unlocks all of my rsa keys with ssh-add on Arch Linux.

I use pass to store my passwords (encrypted with gpg keys) and I'm trying to pass its input to ssh-add as follows:

rsa_dir=~/.ssh
cd $rsa_dir
ls -1 id_rsa* |
grep -v '.pub' |
while read file; do
  # example: file == id_rsa_github -> keyname == rsa/github
  key_name=${file/id_rsa_/rsa/}
  # pass will prompt (only once) for the master password, then print out the request password to stdout
  pass $key_name | ssh-add $file
done

However, it gives an error:

ssh_askpass: exec(/usr/lib/ssh/ssh-askpass): No such file or directory

But if I just run ssh-add $file, it prompts for a password and works fine. I don't want to use the default ssh-askpass to get the password. I need to use my own script.

Can someone please help me?

Answer 1

I was in the same boat as you, so i found two method to do this:

Using xclip

pass yourpassword | xclip -selection clipboard ; ssh-add yourprivatekey

then you just use whatever key you would normally use to paste your password. Bear in mind this use the clipboard, so your password may be noticed by third party if you're not the only user/if you're on untrusted network...

Using Expect

PASS=`pass yourpassword`
/usr/bin/expect <<EOF
set timeout -1
spawn ssh-add privatekey
match_max 100000
expect -exact "Enter passphrase for ~/.ssh/privatekey: "
send -- "$PASS\r"
expect eof
EOF

Should work. Feel free to change the path to your privatekey above, or use autoexpect on a script which have ssh-add yourprivatekey to generate a somewhat working script...

Other idea(s)

The following is what i didn't test or managed to make it work:

• You could use screen or tmux, which have some ways to send keys to a running session...

• You could use some command that send your keys, which could be beneficial for the xclip method above. sendkey on github and xdotool come to mind.