2

For years I have been using a line like this to automatically create an SSH key pair without a passphrase:

/usr/bin/ssh-keygen -q -b 1024 -N "" -C "vagrant@labman01" -f keys/labkey

I typically call ssh-keygen from an Ansible play and then proceed to provision the key to a number of vagrant guest machines when creating a lab environment.

However, since upgrading to MacOS Mojave (10.14.2) the generated key is later reported as invalid by Ansible on the Linux guests, and attempting to use the key manually on the Linux guest causes a prompt for a passphrase, as if the private key is password protected.

Doing the same on any Linux host machine, however, creates a valid key.

Is there some new trick to generate a valid, password free key pair on MacOS Mojave?

UPDATE

When examining the generated key file, I noticed that MacOS Mojave uses -----BEGIN OPENSSH PRIVATE KEY----- instead of -----BEGIN RSA PRIVATE KEY----- as the PEM header. Same thing for the footer.

There appears to be a change in the key format on OpenSSH 7.8 and later. Simply changing the header does not fix the problem.

Improve this question

2 Answers 2

Reset to default
4

There appears to be a change in the default key file format in OpenSSH_7.8p1 and later. MacOS Mojave 10.14.2 ships with OpenSSH_7.9p1.

Adding -m PEM changes the behaviour of ssh-keygen to use the legacy PEM private key format, which was the default on previous Mac OS releases. 

/usr/bin/ssh-keygen -q -m PEM -b 1024 -N "" -C "vagrant@labman01" -f keys/labkey

Unfortunately, the -m option is not supported in earlier versions of OpenSSH, so version specific code must be maintained to sustain older OS releases.

Improve this answer
1

You can try to generate key with nonempty password and after this set the password to empty:

ssh-keygen -b 2048 -t rsa -q -N "password" -f <your_key_file>
ssh-keygen -p -P "password" -N "" -f <your_key_file>

In case of wrong header you can try to change the text:

sed -i -e 's/OPENSSH/RSA/' <your_key_file>
Improve this answer
5
  • A viable suggestion, though it now looks like it has to do with the formatting of the key file. See update in question.
    – Roy
    Feb 10, 2019 at 20:19
  • @Roy, let add some suggestion to my answer
    – Romeo Ninov
    Feb 10, 2019 at 20:20
  • 1
    Aye, that's a fair workaround :-)
    – Roy
    Feb 10, 2019 at 20:23
  • 1
    Oh, I think you forgot -e in the sed (too small a change for me to edit your post)
    – Roy
    Feb 10, 2019 at 20:29
  • 1
    No go. Guess there is more to the format change than just the PEM header :-(
    – Roy
    Feb 10, 2019 at 21:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .