2

I know it's recommended to use ssh keygen to login without password, but find it scary that if someone gets access to my computer in any way, they have the possibility to login to all servers with the stored keys.

So I was thinking of obscuring the process a bit, by setting a password on the identity file, and having a script use a randomized incredible long and hard passphrase to input in plain text to ssh login.

So far, I have generated a ssh-keygen like so, and copied the content of .pub to the server like so:

❯ ssh-keygen -t ed25519
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/username/.ssh/id_ed25519): testssh
Enter passphrase (empty for no passphrase):          <-- This is NOT empty
Enter same passphrase again:                         <-- This is NOT empty
Your identification has been saved in testssh
Your public key has been saved in testssh.pub
The key fingerprint is:
SHA256:vWch2CbFW50FShjCZDJKW59x7iPdXc44FoYFxmr7XIM username@arch

❯ cat ~/testssh.pub | ssh [email protected] 'cat >> .ssh/authorized_keys'
[email protected]'s password: 

Right now, it will ask for the password to the key like so:

❯ ssh -i testssh [email protected]
Enter passphrase for key 'testssh':

But I want to know if something like this is possible:

❯ ssh -i testssh --passphrase="SomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts" [email protected]

So the question is, how do I login using identity file with the password as a argument?

I hope I'm getting my point clear

4
  • 5
    How is storing "incredible long and hard passphrase" more secure than storing a long key in case "someone gets access to your computer in any way"? "I was thinking of obscuring the process a bit" – Security through obscurity? Apr 8, 2021 at 4:49
  • @KamilMaciorowski I don't quite get what you are asking. They are nearly as same secure, but just a slight more obscurity to the process. Having a passphrase in plain text on the key, is better than ONLY having the key, which is again better than having the actual passphrase in plain text (without the identity file)
    – Typewar
    Apr 8, 2021 at 4:54
  • 5
    The key is a long and impossible to remember password. Unfortunately, it is stored on your computer. Now, you want to create a long and impossible to remember passphrase to protect your key. Think a moment - where will you store that passphrase? How will you protect it? Apr 8, 2021 at 5:36
  • 3
    My point is by principle a passphrase hardcoded in a script is not better than only having the key, in case "someone gets access to your computer in any way". A passphrase in your head would be different. IMO you're complicating the process for illusion of better security. You can do it if you want, you can disagree with me, I'm not going to argue hard. Apr 8, 2021 at 5:36

3 Answers 3

2

Assuming you are using the OpenSSH client, you can do this with sshpass.

sshpass -P "Enter passphrase for key" \
 -pSomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts \
 ssh -i testssh [email protected]

Of course, just because you can do this doesn't mean you should. I would urge you to consider the comments that were made on your question.

1
  • 1
    besides the thing about storing the password in plain text in the first place, if you use sshpass, you should pass the password to it via the environment (SSHPASS=mypassword sshpass -e ... ssh ...), or from a file (sshpass -ffilename ... ssh ...). Passing it on the command line with sshpass -p is worse than either of those, since in general the command line is visible to all users on the system, even service users. The man page of sshpass also warns about this.
    – ilkkachu
    Apr 9, 2021 at 22:59
1

I know it's recommended to use ssh keygen to login without password,
[...]
So I was thinking of obscuring the process a bit, by setting a password on the identity file,

This sounds a bit contradictory, so it's hard to tell what you're trying to do.

If you're logging in interactively, then you can just enter the password when using the key/identity file.

On the other hand, if you mean you need to have the key available to some unattended process, and want to store the key password on the same system, then you might as well have no password at all.

But if you want to avoid doing that, you could instead set a regular (good) password/passphrase on the key, and use ssh-agent to hold the unencrypted key for the unattended script to use. Then, you only need to enter the key passphrase once after every reboot, and while the unencrypted key would still be in the system memory, an attacker could not get it by just stealing the drives. Instead, they'd have to break the software security of the system, or do a cold-boot attack to read the memory contents.

Then, also use a forced command in the authorized_keys file on the remote to limit what the key can be used for.

To make the key available to the script with ssh-agent, start the agent and add the key to it after each reboot:

# start the agent, the output contains settings needed to talk to it
# and an 'echo' command printing its PID, remove that one here
ssh-agent | grep -ve ^echo > ~/script-agent-info
. ~/script-agent-info

# add the key to the agent, this asks for the passphrase
ssh-add ~/.ssh/script_id_rsa

and then in the script

# load the agent settings we stored earlier
. ~/script-agent-info

# use the key
ssh somehost@somewhere

(Instead of having the agent generate a random name for the socket it uses, you could use ssh-agent -a to tell it the path, and then just set SSH_AUTH_SOCK to that path in the script.)

0

It seems like there is no way to achieve this with bash or open-ssh alone.

I was able to get it working by using Expect

Expect script:

spawn ssh -i testssh [email protected]
expect "Enter passphrase"
send "SomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts\r"
interact

One-liner:

expect -c "spawn ssh -i testssh [email protected];expect \"Enter passphrase\";send \"SomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts\r\";interact"

Expect looks for Enter passphrase and will type the password send "SomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts\r".

Lastly interact to interact the session


As a note, passwords in plain text should generally never be used

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .