Password in plain text argument for ssh -i (identity_file)

Question

I know it's recommended to use ssh keygen to login without password, but find it scary that if someone gets access to my computer in any way, they have the possibility to login to all servers with the stored keys.

So I was thinking of obscuring the process a bit, by setting a password on the identity file, and having a script use a randomized incredible long and hard passphrase to input in plain text to ssh login.

So far, I have generated a ssh-keygen like so, and copied the content of .pub to the server like so:

❯ ssh-keygen -t ed25519
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/username/.ssh/id_ed25519): testssh
Enter passphrase (empty for no passphrase):          <-- This is NOT empty
Enter same passphrase again:                         <-- This is NOT empty
Your identification has been saved in testssh
Your public key has been saved in testssh.pub
The key fingerprint is:
SHA256:vWch2CbFW50FShjCZDJKW59x7iPdXc44FoYFxmr7XIM username@arch

❯ cat ~/testssh.pub | ssh [email protected] 'cat >> .ssh/authorized_keys'
[email protected]'s password: 

---

Right now, it will ask for the password to the key like so:

❯ ssh -i testssh [email protected]
Enter passphrase for key 'testssh':

But I want to know if something like this is possible:

❯ ssh -i testssh --passphrase="SomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts" [email protected]

So the question is, how do I login using identity file with the password as a argument?

I hope I'm getting my point clear

Answer 1

Assuming you are using the OpenSSH client, you can do this with sshpass.

sshpass -P "Enter passphrase for key" \
 -pSomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts \
 ssh -i testssh [email protected]

Of course, just because you can do this doesn't mean you should. I would urge you to consider the comments that were made on your question.

Answer 2

I know it's recommended to use ssh keygen to login without password,
[...]
So I was thinking of obscuring the process a bit, by setting a password on the identity file,

This sounds a bit contradictory, so it's hard to tell what you're trying to do.

If you're logging in interactively, then you can just enter the password when using the key/identity file.

On the other hand, if you mean you need to have the key available to some unattended process, and want to store the key password on the same system, then you might as well have no password at all.

But if you want to avoid doing that, you could instead set a regular (good) password/passphrase on the key, and use ssh-agent to hold the unencrypted key for the unattended script to use. Then, you only need to enter the key passphrase once after every reboot, and while the unencrypted key would still be in the system memory, an attacker could not get it by just stealing the drives. Instead, they'd have to break the software security of the system, or do a cold-boot attack to read the memory contents.

Then, also use a forced command in the authorized_keys file on the remote to limit what the key can be used for.

To make the key available to the script with ssh-agent, start the agent and add the key to it after each reboot:

# start the agent, the output contains settings needed to talk to it
# and an 'echo' command printing its PID, remove that one here
ssh-agent | grep -ve ^echo > ~/script-agent-info
. ~/script-agent-info

# add the key to the agent, this asks for the passphrase
ssh-add ~/.ssh/script_id_rsa

and then in the script

# load the agent settings we stored earlier
. ~/script-agent-info

# use the key
ssh somehost@somewhere

(Instead of having the agent generate a random name for the socket it uses, you could use ssh-agent -a to tell it the path, and then just set SSH_AUTH_SOCK to that path in the script.)

Answer 3

It seems like there is no way to achieve this with bash or open-ssh alone.

I was able to get it working by using Expect

Expect script:

spawn ssh -i testssh [email protected]
expect "Enter passphrase"
send "SomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts\r"
interact

One-liner:

expect -c "spawn ssh -i testssh [email protected];expect \"Enter passphrase\";send \"SomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts\r\";interact"

Expect looks for Enter passphrase and will type the password send "SomeIncredibleLongAndRandomizedPasswordThatIsMeantToBeUsedForScripts\r".

Lastly interact to interact the session

---

As a note, passwords in plain text should generally never be used