How do I set up SSH so I don't have to type my password?

Question

How do I set up SSH so I don't have to type my password when connecting to a host?

Answer 1

First, generate a SSH key (if you don't have one)

If you happen to use GNOME, the seahorse application ("Passwords and Encryption Keys") can do it for you: File -> New -> Secure Shell Key.

If you prefer terminal, run ssh-keygen -t rsa to generate a RSA keypair. Other types are dsa (more-or-less equivalent, except restricted to 1024 bit keys) and ecdsa (uses much smaller keys with same security, but very new and relatively rare).

If you just press Enter in ssh-keygen, your public key is now stored in ~/.ssh/id_rsa.pub, and the private one is in ~/.ssh/id_rsa. It is highly recommended to leave the paths as they are. (DSA keys will use id_dsa, ECDSA – id_ecdsa. Those are just the defaults, and you are free to choose any name you want.)

Second, upload the public key to the remote server.

Again, seahorse can often do that for you - in My Personal Keys, right-click on your SSH key and choose Configure key for secure shell.

And here's the terminal way, step by step:

1. On the remote server, create a folder .ssh in your home directory.
2. In that directory, create a file named authorized_keys
3. Copy your public key (contents of id_rsa.pub) to the remote authorized_keys file.

Short version: scp ~/.ssh/id_rsa.pub remoteserver:.ssh/authorized_keys

Third, load the key into ssh-agent.

If you load your private key into an agent, it will hold the decrypted key in memory. Otherwise, you would have have to enter the key's passphrase every time you connect.

To load the key, run

ssh-add

and enter the key's passphrase. (If your key is not in the default location ~/.ssh/id_rsa, you will need to provide the full path. For example, ssh-add ~/my-ssh-key)

If ssh-add says "Could not open a connection to your authentication agent.", then you don't have a SSH agent running. Launch one using this command:

eval $(ssh-agent)

If you are using GNOME, gnome-keyring-daemon usually provides the same SSH agent functionality as ssh-agent, so you should not need to start anything. GNOME will automatically load and unlock the key on login, too. (I don't use KDE, so I don't know anything about that.)

Fourth, run ssh to connect to the remote server.

If you loaded your key into the agent as described in step three, ssh will automatically use it. Otherwise, it will try to use ~/.ssh/id_rsa, ~/.ssh/id_dsa, and (if supported) ~/.ssh/id_ecdsa.

Both scp and sftp, which use ssh to connect, can use the key too.

---

Notes:

1. You only need a SSHv2 key, as SSHv1 is very insecure and now unused.
2. You also only need one type of key - either RSA or DSA is enough. (If you picked ECDSA, however, it is recommended to create an additional RSA or DSA keys, since very few servers and clients support ECDSA this moment.)
3. All these steps are the same for both RSA and DSA keys. If you use DSA, use id_dsa instead of id_rsa, and ECDSA will have id_ecdsa. But then, if you care enough to know the difference, you probably have figured that out too.
4. OpenSSH servers older than 3.0 used authorized_keys2 - but it is really unlikely you'll find anything older than 5.0 in use.
5. These instructions only apply for OpenSSH version 3.0 and newer. lsh, ssh.com, and other (Unix and not) SSH servers are not included in this tutorial.

Answer 2

You didn't specify what Unix you're on, what Unix you're connecting to, what shell you're using, what SSH variant you're using, etc. So some of this might need to be adjusted slightly; this is based on reasonably recent versions of OpenSSH, which is used on a lot of unix variants.

This is all from your local desktop system.

ssh-keygen

Make sure to use the default for the keyname. I suggest that you do set a passphrase on that key, otherwise it's a security problem. "-t rsa" wouldn't be a bad idea, but probably isn't needed.

ssh-copy-id username@server

That will ask you for the password you'd use to log in, and sets up the authorized_keys stuff for you. (no need to do it by hand)

Then, this:

`ssh-agent`

or maybe this:

exec ssh-agent sh

or:

exec ssh-agent bash

That will start up an SSH agent that can hold your key. On many modern Unix variants, if you're logged in graphically, this will already have taken place. The first variant (with the backticks) puts an ssh-agent into the background and sets up the environment variables to talk to it. The second two have the agent run a shell for you, so that when you exit the shell, the agent exits.

Many modern Unix variants will already have an agent running for you, especially if you logged in graphically. You might try "ps aux | grep ssh-agent" or "ps -ef | grep ssh-agent"; if something is already running, use that.

Then, finally:

ssh-add

It will ask for a passphrase; give it the one you gave ssh-keygen. There's also ways to make it ask graphically. And you can put the ssh-agent and ssh-add stuff into your login scripts (setup is different depending on shell you use) to automate this, but some Unix variants (current Ubuntu Linux, for instance) do most of that automatically, so that all you really need to do is create a key and use ssh-copy-id to set it up on the remote host.

Now, "ssh username@server" should work without asking for any authentication. Behind the scenes, it's using a key that the ssh-agent is holding, and asking the agent to do the magic signing tricks for it.

Answer 3

It's possible to do this in PuTTY on Windows as well.

Once you have the public/private key pair all set up (as other answers here show) run PuttyGen. In there, load the existing private key that you've already set up, and then save it as a PuTTY private key (ppk).

Then in PuTTY, just click on the saved session you want to auto-login to and click Load. From here go into Connection -> Data in the left pane, and in "Auto-login username" type in the username for that remote server:

After that go into Connection -> SSH -> Auth, and browse for the ppk you made in PuttyGen:

Then go back to the session page and save the session you loaded earlier.

Answer 4

From a very similar question on ServerFault, I'd recommend using ssh-copy-id, which does all the steps involved with setting up authentication keys for you:

ssh-copy-id is a script that uses ssh to log into a remote machine (presumably using a login password, so password authentication should be enabled, unless you've done some clever use of multiple identities)

It also changes the permissions of the remote user's home, ~/.ssh, and ~/.ssh/authorized_keys to remove group writability (which would otherwise prevent you from logging in, if the remote sshd has StrictModes set in its configuration).

If the -i option is given then the identity file (defaults to ~/.ssh/identity.pub) is used, regardless of whether there are any keys in your ssh-agent.

All you need to do is simply this:

ssh-copy-id user@host

Type in your password once, and you're good to go!

Answer 5

http://linuxproblem.org/art_9.html

Your aim

You want to use Linux and OpenSSH to automize your tasks. Therefore you need an automatic login from host A / user a to Host B / user b. You don't want to enter any passwords, because you want to call ssh from a within a shell script.

Answer 6

1. On the connecting host, run ssh-keygen. (If it tells you you have to specify a type, do ssh-keygen -t rsa.) When it asks you for a file location, take the default. When it asks you for a passphrase, hit enter for no passphrase.
2. cat ~/.ssh/id_rsa.pub (or whatever the default file location in ssh-keygen was, though you'd have to have a really old ssh install for it to be different); copy the output to your clipboard.
3. Log in normally to the destination host as the account you want to connect to. Edit the file ~/.ssh/authorized_keys (if ~/.ssh doesn't exist, slogin to someplace; this is the simple, easy way to get it created with the right permissions). Paste your clipboard (containing the id_rsa.pub from the other host) into this file.

Answer 7

One might argue if using such keys does not require a password. To avoid that anyone who gets hold of your private key can actually abuse it, one can protect the key by a password of itself.

Of course, one can leave that password blank, but there's many cases where that wouldn't be recommended.

Answer 8

I guess it was a good idea to quote ssh-keygen for
What’s your favourite piece of (Linux) software nobody’s heard about?
_{(look up at that answer for notes on when it may be a good idea to use a pass-phrase)}

I add public key authentication here again for regular reference.

Answer 9

Apart from all already been told on how to set ssh keys, I recommend Keychain as a ssh-agent console frontend which allows you to handle one only per system process instead of per login.

I know there are already GNOME and KDE tools that do the same but if you are the console junkie type this is great (and can be used on most Unix systems).

To use it, simply append the following to your ~/.bashrc (similar for other shells):

if type keychain >/dev/null 2>/dev/null; then
  keychain --nogui -q <all your SSH/PGP keys>
  [ -f ~/.keychain/${HOSTNAME}-sh ] && . ~/.keychain/${HOSTNAME}-sh
  [ -f ~/.keychain/${HOSTNAME}-sh-gpg ] && . ~/.keychain/${HOSTNAME}-sh-gpg
fi

Answer 10

It looks like the solution involves using authentication keys. Here's a guide to setting it up.