Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to run ssh-agent (with maximum lifetime option), but not add any keys at startup, but instead add them on demand.

Like first time I login to some server it should ask for passphrase, next time (unless I waited for more than a hour) it should connect cleanly:

ssh server1
Enter passphrase for key '/home/vi/.ssh/id_dsa':
server1> ...

ssh server2
server2> # no passphrase this time

# wait for lifetime

ssh server2
Enter passphrase for key '/home/vi/.ssh/id_dsa':

I don't want to manually remember about running 'ssh-add' each time. (e.g. entered passphrase for just for ssh and "Oh, it hasn't remembered, need to retype").

How to configure ssh to automatically add key to ssh-agent if user provided the passphrase?

share
    
possible duplicate of Can I make ssh-agent wait until I use ssh to prompt for a password? –  grawity Aug 20 '11 at 17:56
add comment

3 Answers

up vote 2 down vote accepted

OpenSSH's ssh-agent cannot do that. Features simply do not exist by default.

You could use GNOME Keyring, which comes with its own SSH agent implementation and is able to unlock keys on demand. It requires X11, though.

share
    
May be there's option of ssh client like "if there's id_dsa with passphrase and there's empty ssh-agent then call ssh-add first" or "if there's empty ssh-agent and we just unlocked some privkey then add it to agent"? –  Vi. Aug 20 '11 at 17:46
    
In general, how to use "ssh-agent -t" with comfort? –  Vi. Aug 20 '11 at 17:46
    
No, there is no such option in standard OpenSSH. (That does not mean it wouldn't be implemented -- but you need to ask the developers for it.) // In general, I find it much easier to just lock my desktop when going AFK. It's more secure than a ssh-agent timeout. –  grawity Aug 20 '11 at 17:54
add comment

You could cheat and put something like alias ssh='ssh-add -l || ssh-add && ssh' on your .bashrc / .profile. This first runs ssh-add -l, which can return 0 (there are keys on agent), 1 (no keys) or 2 (no agent running); if it returns 0, ssh will run; if 1, ssh-add will run and then ssh; if 2, ssh-add will fail and ssh won't be run. Replace the && with ; if you want ssh to run even when there's no agent running.

share
3  
It will request passphrase to the key even when further ssh command does not use it. –  Vi. Sep 9 '11 at 15:02
    
@Vi. true, but rare are the commands that don't use them (unless you're connecting to a server that uses keyboard-interactive). The key will be in the agent whenever you need them afterwards though. Also, the alias fortunately (or unfortunately) doesn't change backend uses of ssh (such as with git or rsync). –  Kovensky Apr 3 '12 at 12:05
1  
(thinking about writing auto-call-ssh-add patch for ssh client) –  Vi. Apr 3 '12 at 17:48
    
Based on this answer you can create an aliases for a specific hosts: alias ssh-hostname='(ssh-add -l | grep hostname > /dev/null) || ssh-add ~/.ssh/id_rsa_hostname && ssh -p 12345 username@hostname'. You could even put that in a loop for all your ssh keys and generate aliases. A dirty hack, but it works. –  zmode Apr 19 '13 at 16:04
add comment

Until auto-call-ssh-add is supported by ssh, I added this in my .bashrc, based on Kovensky proposal:

ssh-add -l >/dev/null || alias ssh='ssh-add -l >/dev/null || ssh-add && unalias ssh; ssh'

The alias is created only if the identity is not added, and the alias destroys itself once run.

This way the regular ssh command is used after the identity has been added.

share
    
Will not work in my case because of ssh-add also have timeout configured, but the idea is good enough. –  Vi. Sep 8 '12 at 12:04
add comment

This site is currently not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .