1

I have the some key file

----BEGIN RSA PRIVATE KEY-----
SOMEGARBAGECHARACTERS
-----END RSA PRIVATE KEY-----

but when I am trying to use it with ssh, it asks for some passphrase:

ssh -i mykey.pem [email protected]
Enter passphrase for key 'mykey.pem':

Is this just mean that inside this file some keyphrase is encoded? Or does mean something else?

UPDATE

No any DEK lines or something. Only homogeneous mass of random characters.

UPDATE 2

Key file was somehow corrupted. I received it by email and copypasted to text editor. There were no apparent differences but actually they were there. After I opened email with raw editor and copy/pasted key this way -- everythin worked.

As @Jakuje suggested, I used openssl tool and it reported an error.

Improve this question
6
  • Is there a "DEK-Info:" line at the top?
    – u1686_grawity
    Jul 20, 2016 at 6:51
  • 1
    Some example keys, encoded versus un-encoded here. serverfault.com/a/628980/984
    – Zoredache
    Jul 20, 2016 at 6:59
  • The passphrase isn't within the private key, the passphrase is only in user memory, the passphrase protect the private key.
    – dan
    Jul 20, 2016 at 7:03
  • @danielAzuelos I swear I have no passphrase in my memory
    – Dims
    Jul 20, 2016 at 7:13
  • Then, please describe how you created this (private key, public key) pair. The origin of the problem stands there.
    – dan
    Jul 20, 2016 at 9:34

3 Answers 3

Reset to default
3

OpenSSH asks for passphrase for every garbage input. There is open bug for that upstream. It can be very confusing for a lot of users.

Only way to check what is behind that is to use openssl directly:

openssl rsa -text <mykey.pem

It should ask for a passphrase or report any other error in the key.

Improve this answer
2

It means the key itself was encrypted using a passphrase. To log in with the key, ssh first needs to decrypt it.

Improve this answer
2
  • Are you absolutely sure? There is no any DEK lines or something inside file.
    – Dims
    Jul 20, 2016 at 7:12
  • In that case, see Jakuje's answer.
    – u1686_grawity
    Jul 20, 2016 at 11:04
0

When you create a private key, you can choose to protect it with a password. If you are 100% sure nobody (and no virus or anything) will ever copy that key, you can do without. Same if the key is for something that has no value like a local test machine with nothing of importance on it. Otherwise it's good practise to use a password.

If the private key is protected, the key is encrypted using that password, and you need to use the password to unlock the key. So it's normal that SSH asks for a password to use the key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .