4

On my Macbook, my SSH private key is encrypted, but I never have to re-enter the passphrase even if I reboot the machine.

The system must be unlocking it along with my user account.

Is it possible to set it up the same way for my user account on a CentOS server? There should be some sort of option that would basically encrypt the privatekey with the user account password (or at least encrypt the passphrase with the user password). I do not want the private key in plaintext on the hard disk, and would prefer not to have to enter many passwords.

If the answer is no, then I probably will need to enter it once each time the server is booted. That is less good, but since that should be a rare occurrence, that would be tolerable.

2 Answers 2

Reset to default
3

It appears that the RPMForge repo that is sourced for keychain in the Cyberciti.biz article is no longer recommended by CentOS. However I was able to install keychain using the GhettoForge repo which is also referenced in the Centos wiki.

First, I copied the URL for the GhettoForge public RPM keys for my version of CentOS( they provide 5, 6, and 7, but I only needed the one for 6 ). Next, I copied the URL for the newest 'gf-release' package from GhettoForge's Usage page. Finally, I ran the following commands from my server to install keychain( keep in mind that your URLs may be different ):

rpm --import http://mirror.symnds.com/distributions/gf/RPM-GPG-KEY-gf.el6
rpm -Uvh http://mirror.symnds.com/distributions/gf/el/6/gf/x86_64/gf-release-6-10.gf.el6.noarch.rpm
yum clean all
yum install keychain

Additional note: It appears that at this time keychain is only available for CentOS 5 and 6 from GhettoForge's repo.

3
  • I use centos 7 now. I also gave up and use unencrypted privkeys. ¯\_(ツ)_/¯ So far ssh agent forwarding keeps stuff simple.
    – Steven Lu
    Dec 2, 2016 at 21:59
  • @StevenLu Thanks for the update, and suggestions! It's probably a good idea no to use unencrypted private keys.
    – FCTW
    Dec 5, 2016 at 15:29
  • Yes... I think maybe I didn't mean what I wrote... I have generally been successful in setting up ssh agent forwarding on my servers. This means that I can avoid setting up ssh keys (encrypted or otherwise) on my servers themselves, and simply distribute the public keys of my trusted device ssh keys (which are always encrypted private keys), and the ssh key forwarding makes everything just work. It would cease to work when the server runs scripts that involve ssh credentials (such as fetching private git repos), however.
    – Steven Lu
    Dec 5, 2016 at 15:40
2

You need a keyring or keychain to maintain the ssh-agent auth socket location for you.

On CentOS you can install keychain, see http://www.cyberciti.biz/faq/ssh-passwordless-login-with-keychain-for-scripts/ for a detail guide on how to setup keychain on CentOS.

4
  • Is there a way to get this to restore the passphrases upon server reboot? (it should be able to do this by encrypting the passphrases with the user login)
    – Steven Lu
    Jul 19, 2013 at 18:40
  • @Steven No keychain/keyring program will persist the passwords across reboots, it's not secure. If you are looking for solution to manage your passwords/keys, try LastPass/1Password/etc. and that should never runs on your servers.
    – number5
    Jul 22, 2013 at 6:47
  • I did get it set up and it works nicely. Entering once on reboot is perfectly fine.
    – Steven Lu
    Jul 22, 2013 at 13:05
  • Now trying to update my scripts for Centos 7, this does not seem so simple. I don't know why I was okay with installing a repository using a http url to begin with. But this whole keychain business is already a bit of a tin-foil-hat contraption to begin with. I am going to use a well-encrypted private key on machines that need it (and type the pass to unlock that key when it is used there), and generate unencrypted private keys on other general purpose environments. Don't need to have any more impediments than there already are...
    – Steven Lu
    Feb 11, 2015 at 9:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .