0

When I ssh into my Ubuntu 20.04.1 system from my Mac 12.6 system, I am being prompted for my key passphrase each time, but don't know how to get rid of the prompt. Below is the output from the Ubuntu system, where I manually ran the sshd in debug mode, but I'm not familiar enough with what it is showing to determine what is wrong.

root@dell:/etc/ssh# mkdir /var/run/sshd; chmod 0755 /var/run/sshd; /usr/sbin/sshd -d
debug1: sshd version OpenSSH_8.2, OpenSSL 1.1.1f  31 Mar 2020
debug1: private host key #0: ssh-rsa SHA256:Qi+QfQXlZMNzXx2rc4lTr8Sa2n8NzGShKKlFHlgIJT4
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:XqYwNkxd/ELRRSp2tzfOAst5H+xwJUjZF95BfkCLIYk
debug1: private host key #2: ssh-ed25519 SHA256:wIWr6ju0DTop8DTREi+uJPxvHJvT+eJxXFq/jgMaJFU
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: sshd version OpenSSH_8.2, OpenSSL 1.1.1f  31 Mar 2020
debug1: private host key #0: ssh-rsa SHA256:Qi+QfQXlZMNzXx2rc4lTr8Sa2n8NzGShKKlFHlgIJT4
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:XqYwNkxd/ELRRSp2tzfOAst5H+xwJUjZF95BfkCLIYk
debug1: private host key #2: ssh-ed25519 SHA256:wIWr6ju0DTop8DTREi+uJPxvHJvT+eJxXFq/jgMaJFU
debug1: inetd sockets after dupping: 3, 3
Connection from 192.168.1.9 port 63434 on 192.168.1.30 port 22 rdomain ""
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.6
debug1: match: OpenSSH_8.6 pat OpenSSH* compat 0x04000000
debug1: permanently_set_uid: 126/65534 [preauth]
debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ssh-ed25519 [preauth]
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: rekey out after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: Sending SSH2_MSG_EXT_INFO [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: rekey in after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user mth service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "mth"
debug1: PAM: setting PAM_RHOST to "192.168.1.9"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user mth service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: userauth_pubkey: test pkalg rsa-sha2-512 pkblob RSA SHA256:OZm4uD0KuWx6Z494aecU2mD4GmWpmujCXaZkE+D2icY [preauth]
debug1: temporarily_use_uid: 1000/1000 (e=0/0)
debug1: trying public key file /home/mth/.ssh/authorized_keys
debug1: fd 4 clearing O_NONBLOCK
debug1: /home/mth/.ssh/authorized_keys:1: matching key found: RSA SHA256:OZm4uD0KuWx6Z494aecU2mD4GmWpmujCXaZkE+D2icY
debug1: /home/mth/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Accepted key RSA SHA256:OZm4uD0KuWx6Z494aecU2mD4GmWpmujCXaZkE+D2icY found at /home/mth/.ssh/authorized_keys:1
debug1: restore_uid: 0/0
Postponed publickey for mth from 192.168.1.9 port 63434 ssh2 [preauth]

I would appreciate any hints. Thank you.

1 Answer 1

2

This isn't really a problem per se - your private key on your Mac system is protected by a passphrase, and that private key must be unlocked before it can be presented to the Ubuntu system for authentication.

You have two options - the first is to use ssh-agent and ssh-add to unlock the private key once into an in-memory agent, using that unlocked agent to present your identity to the Ubuntu system. This is the "better" option, as it leaves the identity protected by the passphrase. I put better in quotes since I feel that's more of an opinion on whether this option is better because it keeps the key secure or worse because it means extra steps of dealing with agent every time you boot the system.

$ eval `ssh-agent`
Agent pid 123456
$ ssh-add
Enter passphrase for /home/user/.ssh/id_rsa:

The agent PID above will change each time you run the eval command. The identity file will be where you have stored your private identity file, and will be the same every time you run the eval command.

The second option is to create a new SSH keypair without a passphrase, distribute the new public key to your Ubuntu system, and use the unprotected identity.

Edit: You can also use ssh-keygen -p to remove the passphrase from the existing keypair, as dave_thompson_085 points out in a comment.

1
  • You don't need to create a new keypair, you can use ssh-keygen -p to remove the passphrase from the existing one. Commented Oct 19, 2022 at 0:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .