2

I currently have a setup which allows me to connect to all computers on my home network via SSH and RSA keys. I'm very security-conscious, so all of my keys are passphrase protected. I'd like to essentially set something up where I'm running Unison on a cron job to back up to a file server on my network, which we'll call timmy. I've noticed that the first time I try to use a key on my Ubuntu laptop teeks, I get a dialog which pops up asking me to type in my key passphrase. I've heard that for servers needing to make automated backups like this that one should use ssh-agent to ask for the key passphrase on login/server start. How can I set this up on teeks?

I'd essentially like to have the following happen:

  1. When I boot and come into the OS, prompt visually for the passphrase as is done when I first use a key.
  2. If I SSH into this computer (as it's internet-facing) and I haven't provided the SSH passphrase yet, then prompt for it. (Sometimes, I might need to remotely reboot the machine over SSH, so I'll be SSH'ing into it after it reboots and I'd like to be able to authenticate the key without having to VNC in and do it manually.)

Is there a tool that I can use to accomplish this?

2 Answers 2

1

You can start ssh-agent when you login to the shell by placing the following in your .profile:

SSH_ENV="$HOME/.ssh/environment"

function start_agent {
     echo "Initialising new SSH agent..."
     /usr/bin/ssh-agent | sed 's/^echo/#echo/' > "${SSH_ENV}"
     echo succeeded
     chmod 600 "${SSH_ENV}"
     . "${SSH_ENV}" > /dev/null
     /usr/bin/ssh-add;
}

# Source SSH settings, if applicable

if [ -f "${SSH_ENV}" ]; then
     . "${SSH_ENV}" > /dev/null
     #ps ${SSH_AGENT_PID} doesn't work under cywgin
     ps -ef | grep ${SSH_AGENT_PID} | grep ssh-agent$ > /dev/null || {
         start_agent;
     }
else
     start_agent;
fi
11
  • So what will this actually mean in my use case? If I SSH into the machine after it has initially booted, will it display this if the keys haven't been unlocked yet? Conversely, if I SSH in and I've already unlocked keys, I won't have to re-enter the passphrase? Will it correctly do everything after a fresh boot? Jun 10, 2011 at 22:43
  • 1
    This will start ssh-agent when you login. If the script finds a running ssh-agent, then you don't need to re-enter the passphrase. Else, it will start a ssh-agent and prompt you for the passphrase. The script is only run when you login. After a fresh boot, there will be no running ssh-agent. The ssh-agent will start when you log in.
    – Chris Ting
    Jun 11, 2011 at 0:22
  • What about the graphical vs shell aspect of it? Will it both prompt in a SSH session the first time and prompt graphically, with a "first one wins" type of authentication? Thanks for your answer, it seems to be what I'm looking for. Jun 11, 2011 at 0:33
  • 1
    You should only be prompted on first login. It doesn't matter if that login is graphical or from the shell. On second login, there's a check for a running ssh agent, and if one is found then you won't see another prompt.
    – Chris Ting
    Jun 11, 2011 at 14:30
  • Actually, this totally messed everything up on my laptop. When I'd log in, I'd get prompted graphically for the SSH password, and then it would essentially return me to the login screen. I had to boot to a root shell and edit my profile to prevent this from happening. What went wrong? Jun 20, 2011 at 2:29
0

For avoid to enter ssh passwords (and automate tasks) you can use ssh certificates, the basic setup is to generate a certificate for the user you want to log from, then copy this certificate to the machine(s)/user(s) you want to connect to. It's necesary to ensure that your ssh server is configured to accept certificate login. You must ensure your certificate doesn't gets compromised when you copy it fron one machine to another.

You can see samples at http://www.panticz.de/ssh_certificate_authentication and more in depth information at openssh site http://www.openssh.com/

Regards

2
  • Reread the question... OP states that he's using RSA certificate-based authentication. The issue is that his private keys are themselves encrypted, so he needs a way of entering the passphrase to access the key. He is not using password-based ssh authentication. Jun 8, 2011 at 9:26
  • Sorry, I'm not native english speaker and I missed the question ;-). And then... Why not store certificates non encripted? I remember that I had this issue with apache certificates, it was necessary to enter the passphrase every time apache was restarted, since I trusted muy own server I saved the certificate unencripted and that worked for me.
    – franblay
    Jun 13, 2011 at 7:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .