Automated ssh-keygen without passphrase, how?

Question

I would like to make an automated script that calls ssh-keygen and creates some pub/private keypairs that I will use later on. In principle everything works fine with....
ssh-keygen -b 2048 -t rsa -f /tmp/sshkey -q
...except that it asks me for the passphrase that would encrypt the keys. This make -at present- the automation difficult.

I could provide a passphrase via the command line argument -N thepassphrase, so to keep the prompt from appearing. Still I do not even desire to have the keys -additionally secured by encryption- and want the keypairs to be plaintext.

What is a (the best) solution to this problem?

The -q option which supposedly means "quiet/silent" does still not avoid the passphrase interaction. Also I have not found something like this
ssh-keygen ... -q --no-passphrase

Please do not start preaching about or lecture me to the pro and cons of the "missing passphrase", I am aware of that. In the interactive form (not as a script) the user can simply hit [ENTER] twice and the key will be saved as plaintext. This is what I want to achieve in a script like this:

#!/bin/bash

command1
command2
var=$(command3)

# this should not stop the script and ask for password
ssh-keygen -b 2048 -t rsa -f /tmp/sshkey -q

Answer 1

This will prevent the passphrase prompt from appearing and set the key-pair to be stored in plaintext (which of course carries all the disadvantages and risks of that):

ssh-keygen -b 2048 -t rsa -f /tmp/sshkey -q -N ""

Using Windows 10 built in SSH

PowerShell:

ssh-keygen -b 2048 -t rsa -f C:/temp/sshkey -q -N '""'

CMD:

ssh-keygen -b 2048 -t rsa -f C:/temp/sshkey -q -N ""

Answer 2

The simplest way I found to do what you want is this (example using default filename)

    < /dev/zero ssh-keygen -q -N ""

If the ~/.ssh/id_rsa file already exists, the command will exit without modifying anything.

If not, you get a brand new key, in that filename.

Either way, you haven't overwritten anything, and you know at the end you have a key.

Answer 3

This worked for me:

ssh-keygen -t rsa -f /home/oracle/.ssh/id_rsa -q -P ""

The -P is the passphrase option, and "" is the empty passphrase.

Answer 4

You can use expect to send the "enter" for you

cat test.sh
#!/bin/bash
set -x
XYZ=$(expect -c "
spawn ssh-keygen -b 2048 -t rsa -f /tmp/sshkey -q
expect \"Enter passphrase (empty for no passphrase):\"
send \"\r\"
expect \"Enter same passphrase again:\"
send \"\r\"
")

But be aware, that if the file /tmp/sshkey already exists it will fail because the output of the command will be different.

Answer 5

For another user, tested on Ubuntu 18.04:

sudo -u username bash -c "ssh-keygen -f ~username/.ssh/id_rsa -N ''"

Answer 6

I did a simple echo before ssh-keygen. So su - <user> -c "echo |ssh-keygen -t rsa"

This was tested on Redhat 6

Answer 7

ssh key generation function which can be put into .bashrc or .bash_aliases

# Make an ssh key if not exists, and copy ssh key to clipboard
# needs xclip to copy to system clipboard
ssh-key-now () {
    cat /dev/zero | ssh-keygen -t ed25519 -C "made with ssh-key-now" -q -N ""
    xclip -sel clip < ~/.ssh/id_ed25519.pub
    echo "ssh-key copied to clipboard"
}

Saves time when you've reinstalled OS and lost your ssh keys and have to set up gitlab/github again

Answer 8

The following works:

sudo -u user ssh-keygen -t rsa -N '' <<<''

It is intended to create the directory ~user/.ssh/, so that the file ~user/.ssh/authorized_keys can be created and updated to hold a public key for incoming ssh access.

A key pair is also generated but not needed for this purpose.

For example, one can prepare a boot-time init (kernel) parameter to preseed a live system for ssh access as follows:

ID=$(cat ~/.ssh/id_rsa.pub)
pr1="sudo -u user ssh-keygen -t rsa -N '' <<<''; echo '$ID' | sudo -u user tee -a ~user/.ssh/authorized_keys"

Include "$pr1" in the appropriate kernel parameter as a command which gets run automatically, as in ocs_prerun1="$pr1" for Clonezilla. Also verify that ssh service is enabled, as in ocs_daemonon="ssh".