Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have ssh public keys set up on my computers. They have passphrases. Whenever I need to, e.g. push to github, I have to type in the passphrase. Each time. And I'd rather ssh remembered on subsequent accesses.

ssh-agent/keychain seem to just about fit the bill, except they bother me for the passphrase when I log in (when I might not be sure I need to use my ssh keys), not when I'm trying to use ssh.

Is there some feature in either of those tools or some other tool that would remember the ssh passphrase, but maybe grab it when I type it in for ssh instead of when the session opens?

I somehow got this working on a Fedora 16 box a while ago, but can't remember what I did.

share|improve this question
    
This would be less of an issue if I just left my computers on, but that costs power, and power costs money, and I hate spending money. –  Ellery Newcomer Feb 14 '13 at 4:14
    
Try setting it up with the passphrase being your password, so it can unlock keys automatically on login. –  cpast Feb 14 '13 at 4:15

3 Answers 3

This is the default behavior of GNOME Keyring's internal SSH agent.

Add these modules to the respective sections of your PAM configuration in /etc/pam.d/system-login (or, for GDM, gdm-password).

auth       optional   pam_gnome_keyring.so only_if=login,gdm-password

and

session    optional   pam_gnome_keyring.so only_if=login,gdm-password auto_start

This should be enough if you use GNOME (which starts the keyring daemon from XDG Autostart). If you're using any other environment, add this to your .xinitrc (for startx) or .xprofile (for gdm/lxdm/kdm):

if [ "$GNOME_KEYRING_CONTROL" ]; then
    eval $(gnome-keyring-daemon --start)
fi
share|improve this answer

If you run ssh-agent without providing it with a key, you can later run ssh-add the first time you need the key.

share|improve this answer

Use gpg-agent. It can handle SSH keys in addition to PGP keys, asks for your passphrase once only when you need it and uses pinentry for the input.

Add this to ~/.xinitrc or ~/.xprofile :

eval $(gpg-agent --enable-ssh-support --daemon)

After you logout/login, you will need to issue ssh-add to ask gpg-agent to handle your SSH key. This is needed only the first time you use gpg-agent, not after each login.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.