Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to know if is there a way to put a new "Layer" when the SO(preferentially a Ubuntu or a Mac OS X) asks for the passphrase of a rsa key.

How it normally does:

Use ssh;

prompt the window to enter the passphase;

enter the passphrase and hit enter;

How I would like to be:

Use ssh;

run in the background a python script that send the password for the rsa key

I would like that this could be done in any Unix system?

If possible, is it easy to configure this? Like, edit some lines in a configuration file or so?

Thanks

share|improve this question
1  
What do you mean by an SO? –  cpast Feb 14 '13 at 1:48
    
ups, sorry, I misspelled it: OS(Operating System) –  Arruda Feb 14 '13 at 4:11

2 Answers 2

Doing this entirely defeats the purpose of a passphrase. The reason you use a passphrase for ssh keys is so that someone who compromises your computer and steals your private key can't decrypt and use it. If a script supplies the passphrase, you need to store it in plaintext on your hard drive, and that means that an attacker can easily recover it and compromise your key.

If you want to just enter a passphrase once per session (so you'd enter it when you first ssh and then not have to enter it again), look into ssh agents. On some systems, you can even make your password the passphrase, so it unlocks when you log in. However, writing a script to auto-enter the passphrase means you'd be better off just removing the passphrase entirely.

share|improve this answer
    
It's because I intend to do a python script that will check a usb file encripted with the passsword and that can only be decripted with another file from my pc. –  Arruda Feb 14 '13 at 2:12
    
You're still protecting your identity with an unencrypted file (the last file you mentioned). You're still defeating the point of a passphrase - an attacker who compromises the system when the flash drive is plugged in gets your key. Why not use agents properly and only enter the passphrase once? You can even set it so its passphrase is your password, and it unlocks at login. –  cpast Feb 14 '13 at 2:22
    
Also, rolling your own security stuff can end badly. –  cpast Feb 14 '13 at 2:23
    
I know that this last file ins unencrypted, but it only has the key to the key(usb). I can say that the idea is to have a easy way to dont use the passphrase(using a USB, a physical key) instead of using the agents to enter the passphrase once. And also this would help me to learn more about this stuff =) (thanks for the security warning) –  Arruda Feb 14 '13 at 3:01

Have a look at gpg-preset-passphrase. Perhaps that's what you need. Or you talk directly to gpg-agent via the Assuan protocol.

share|improve this answer
    
I looked at the gpg-preset-passphrase, but couldn't find it in the gnuPG package for ubuntu. In it really in this package? I can't say for sure this is really the answer I'm looking for, but for what I was reading it looks like so. =) thanks –  Arruda Feb 16 '13 at 21:17
    
@Arruda It's part of the openSUSE gpg2 package (there /usr/lib64/gpg-preset-passphrase, not in $PATH though!). –  Hauke Laging Feb 17 '13 at 1:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.