Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have several users on my server and as such a separate public/private key pair for each.

The problem is that once they're added as identities (Mac OS X 10.8.4 if it makes a difference), when I connect with a user account it goes through all the keys trying to find the right one. This doesn't work so well because of MaxAuthTries.

I'd be fine with increasing my MaxAuthTries to 100 or so but, although it accepts that under a matched host, it doesn't override the original, and I really don't want to give general public 100 auth attempts for my ssh server; configuration:

MaxAuthTries 2

Match host 1.2.3.4
        MaxAuthTries 100

MaxAuthTries does nothing for my ip; it still limits it to 2.

This solution wouldn't be ideal but would be acceptable if it can be done. When using a key far down the list, it takes some time to check them all and find the right one (especially if my internet connection is lagging)... Plus sending all my keys, encrypted or not, makes me uncomfortable.

Ideally, I need to connect with the correct key file and not bother trying the others. The problem is that I have most of my passcodes saved to my keychain so if I clear my identities I loose all the saved passcodes.

If this isn't possible, I need a way to change my MaxAuthTries to a big number for my IP. I thought of doing it with IPTables but I use Plesk and rather like to be able to actually use the interface to manage my firewall.

Thanks a bunch!!

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I was just about to start a bounty for this and realized the answer was so simple...

SSH agent data is not encrypted so it can be retrieved via a shell script, and I use bash to select the correct username, server, etc, based on a given domain (which would be a vhost on said server).

I solved this by exporting the public key from my ssh agent to a file, forcing the use only of that key, and then deleting the public key.

Here's my bash script (hopefully it's helpful to others!):

#!/bin/bash
remove_public () { # remove the public key after 2 seconds
  sleep 2
  rm -f $HOME/.ssh/public_key $HOME/.ssh/config
}

get_public () { # get the public key from ssh-add
  ssh-add -L | grep "$1" > $HOME/.ssh/public_key
  if [ ! -s "$HOME/.ssh/public_key" ] #identity hasn't yet been loaded
  then
    export KEY="$1" #use the private key it'll be added to the agent for next time assuming agent is configured.
  else
    export KEY="$HOME/.ssh/public_key" #use the public key
    ( remove_public & ) >/dev/null 2>&1
  fi
  chmod 700 "$KEY"
  echo "IdentitiesOnly=yes" > "$HOME/.ssh/config"
  echo "IdentityFile $KEY" >> "$HOME/.ssh/config"
}

ssh_connect () {
  chmod -R 700 $HOME/.ssh
  if [[ -z "$1" || -z "$2" ]]
  then
    echo "Username or server not specified!"
    exit 1;
  else
    get_public "$HOME/.ssh/$2"
    ssh "$2@$1" -i "$HOME/.ssh/$2"
  fi
}

WARNING if you actually have an ssh_config file, this WILL delete it. But it's important to remove IdentitiesOnly and IdentityFile; otherwise, ssh will be broken for connections not using this script.

Usage:

ssh_connect "server" "username"

This is a stripped down version of the shell script I wrote because my keys aren't always in the same directory (in fact they never are, they're sorted by server), I always pass a screen command to the server, etc.

Also note that in the rm command if you're concerned about security of the deleted public key, you can use rm -fP instead of rm -f if you're using Mac OSX to overwrite the file 3 times before deletion. I don't know what other, if any, OSs support it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.