10

I am using Awesome Window Manager

How can I permanently add private keys with password?

Inspired by the answer here I have added the private keys in ~/.ssh/config

Contents of ~/.ssh/config:

IdentityFile 'private key full path'

Permissions of ~/.ssh/config: 0700

But it doesn't work for me.

If I manually add the key in every session, it works but I'm looking for a more elegant way (not in .bashrc)

EDIT:

  • Using Gnome classic (no effects) version.

After adding the SSH key with ssh-copy-if to the remote host, I get the following prompt in terminal (GNOME Terminal 3.0.1) when I'm logging in:

ssh -i .ssh/Password-Protected-Key user@host
Enter passphrase for key '.ssh/Password-Protected-Key':
  • Using Awesome window manager v3.4.10. I had already gnome-keyring-dameon so I killed the other pid and run gnome-keyring-daemon --start | grep SOCK (I also added it in .profile) the (grep) output:

SSH_AUTH_SOCK=/tmp/keyring-2LXXXX/ssh

I followed the exact same steps and likewise I haven't got any GUI ssh-add dialog.

EDIT 2:

I created a new password protected key from Ubuntu 11.10 virtual machine on unity and I still can't get any password prompt.

EDIT 3: It seems that this cannot work in Awesome window manager :( and possibly other..

dessert
  • 39,392
  • 12
  • 115
  • 163
pl1nk
  • 6,229
  • 5
  • 26
  • 46
  • 1
    What's the point of adding a password-protected SSH key? It defeats the purpose... – MarkovCh1 Jun 02 '12 at 22:49
  • 3
    @Syzygy Well do you type always the passwords from different services and apps or are you using a keyring to unlock your password with your login password? – pl1nk Jun 02 '12 at 23:58
  • Any more thoughts/questions, pl1nk? Bounty grace period expires REALLY soon :-) – ish Jun 09 '12 at 22:17
  • @izx I have checked everything that you mentioned and are all as expected. As I mentioned on my update I had also used Gnome. Shall I file a bug? – pl1nk Jun 10 '12 at 00:08
  • You might find some clues [here](http://superuser.com/questions/312872/how-to-automatically-add-a-protected-key-to-ssh-agent-on-startup). Looks like the order in which things start is important, and for gnome-keyring-daemon getting to the dbus is important as well. – John S Gruber Jun 10 '12 at 01:02
  • @JohnSGruber - I have tried many workarounds but to no avail. It seems that I need to file a bug but I don't know where to start from. – pl1nk Jun 10 '12 at 23:40
  • @ pl1nk, I'd suggest using izx's solution below. He and I have been editing it and it works with a fresh awesomewm manager with a fresh userid on my system. Catch me in the chatroom if it doesn't work for you and you want to look at details. – John S Gruber Jun 11 '12 at 04:20
  • You can also use this link for your generic ssh-worries [http://superuser.com/questions/8077/how-do-i-set-up-ssh-so-i-dont-have-to-type-my-password#_=_][1] [1]: http://superuser.com/questions/8077/how-do-i-set-up-ssh-so-i-dont-have-to-type-my-password#_=_ – ksinkar Oct 25 '12 at 10:42
  • @ksinkar Not helpful, these is no reference for password protected keys. – pl1nk Oct 25 '12 at 11:02

5 Answers5

19

Making a password-protected SSH key persist across sessions and reboots

This is probably what you want: entering the key passphrase once makes it available for ever whenever you're logged in. It will work for most users who are using the Unity or Gnome desktops.

  • When you connect after adding the public key to the remote server, you'll get the GUI ssh-add dialog:

    enter image description here

  • Expand the "Details" by clicking on the triangle, and you'll get the below. The default is "lock keyring when I log out", which requires you to enter the password once per session:

    enter image description here

  • Change it to Automatically unlock...whenever I'm logged in, which means it will work whenever you have logged in to your session -- it's "controlled" by your user password. It will persist across reboots.

    enter image description here

  • Enter the key passphrase once and that's it - the key is authenticated via the initial successful login to your desktop environment.

If you are using AwesomeWM

Tested with a fresh install of AwesomeWM in a fresh userid

  • By default, AwesomeWM uses ssh-agent:

    $ export | grep SSH
declare -x SSH_AGENT_PID="5479"
declare -x SSH_AUTH_SOCK="/tmp/ssh-fWCKNnPq5440/agent.5440"

  • To get the above steps to work, you must use gnome-keyring-daemon as the SSH authentication daemon, not ssh-agent. When you login using lightdm, PAM starts gnome-keyring-daemon that will try to unlock a login key with your unlock password, but you must add to you configuration to keep it running and use it.

  • Add the following to the end of your ~/.xprofile:

      #!/bin/bash
  eval $(gnome-keyring-daemon --start)
  export SSH_AUTH_SOCK
  export GNOME_KEYRING_PID
  export GNOME_KEYRING_CONTROL

The commands in the ~/.xprofile file will be executed by xsession before starting the awesome window manager and will tie it to the gnome-keyring-daemon --login process started by PAM through the above environment variables.

  • Logout back to lightdm and log back in, and now when you do ssh user@host, you should get the above popups -- use those to decode your private keys in ~/.ssh/ and save your private keys to the gnome-keyring login keyring.

The general solution for any window manager/desktop environment

  • is to use gnome-keyring-daemon instead of ssh-agent. For this, you need to be running gnome-keyring-daemon and have it initialized and either do this after ssh-agent is started or not start ssh-agent at all.

  • ssh (actually ssh-add) decides which authentication agent to call based on the value of the SSH_AUTH_SOCK environment variable, which can be checked by typing export | grep SOCK

  • this is of the form SSH_AUTH_SOCK=/tmp/ssh-MMFyVlI22130/agent.22130 for ssh-agent (NOT what you want to be able to save your key)

  • but of the form SSH_AUTH_SOCK="/tmp/keyring-mEQB5g/ssh" for gnome-keyring-daemon (which you want)

  • so check the value, and check with ps aux | grep keyring that gnome-keyring-daemon is running, and if so, initialize it with the results of gnome-keyring-daemon --start

  • you can then check the associated saved identities in the console by typing ssh-add -l -- if it shows "no agent" then you made a mistake configuring gnome-keyring-daemon.

John S Gruber
  • 13,248
  • 3
  • 37
  • 64
ish
  • 138,666
  • 36
  • 303
  • 312
  • Well I haven't seen this! Which command may I use or even better what command this dialog calls? – pl1nk Jun 08 '12 at 23:25
  • @izx when using this is it necessary to use ssh-add? – John S Gruber Jun 09 '12 at 02:16
  • @JohnSGruber No, as long as the private keys are in `~/.ssh`, there is no need to use `ssh-add` -- the dialog will pop-up upon first use. Note that this only works in Unity/Gnome -- I discovered in chat that the OP is using *AwesomeWM*, where this doesn't work! – ish Jun 09 '12 at 02:35
  • 1
    @pl1nk : please see updated solution for AwesomeWM towards the end of the answer. – ish Jun 09 '12 at 07:09
  • @izx - Thank you for your overall support check my updated question. – pl1nk Jun 09 '12 at 10:44
  • From my testing it looks like the gnome-keyring-daemon also supports the -A option for agent forwarding as with ssh-agent. – John S Gruber Jun 09 '12 at 14:39
  • I installed awesome wm and got this approach to work. Each time bash starts in a terminal session the eval sets the appropriate environment variables. The daemon is already started and another isn't started when the `eval $(gnome-keyring-daemon --start` statement is executed. – John S Gruber Jun 10 '12 at 06:22
  • @JohnSGruber, suppose you have one terminal running, and you start another, are you sure that re-initializing the one and only copy of the daemon won't affect authentication in the first terminal? That's the only reason I chose to put that in `.profile`, which should run every time you log in to a new session. In any case, happy to add your edit :) – ish Jun 10 '12 at 06:24
  • @izx Neither execution actually starts a new daemon. Looking from another login there's a `gnome-keyring-daemon` started before the first terminal is started, and that same one daemon is running after each of several terminal is started. The execution of .bashrc (or similar) must simply find it and it corrects the environment with the correct values for its own process and its subprocesses (SSH_AUTH_SOCK, in particular, who's name takes a new form). Running it from .profile didn't work for me. I don't know about running your grep pipe from .bashrc. – John S Gruber Jun 10 '12 at 15:33
  • This is not working for awesome wm. – pl1nk Jun 13 '12 at 00:52
  • @izx is there any way I can manually trigger that dialog box? I already put my password without clicking details. I don't want to delete my ssh-keys & start from beginning. I want to change it to `automatically unlock when login`. Where gnome-keyring-settings are saved? – Khurshid Alam Nov 04 '13 at 16:36
  • @izx Gnome-keyring method does not work after relogin(logout & login again) to unity in Ubuntu-13.10.Any idea why? – Khurshid Alam Jan 18 '14 at 09:01
  • Thank you - after years of typing in my password manually in Awesome, I finally got the keyring manager working again! I don't use a display manager, so I had to edit my `.xinitrc` instead (`.xprofile` is only called from display manager). – Martin Konecny Oct 28 '14 at 23:47
2

The solution to your problem is using the ssh agent. You just have to unlock the password of your key once, after that it's retained in memory by the agent and used automatically

  • Generate a private/public key pair with ssh-keygen -t dsa
  • Copy the public key to the remote machine, usually this is ~/.ssh/authorized_keys (use ssh-copy-id for this)
  • Run ssh-add before login in to the remote system, this will ask for your passphrase and store it
  • Login to the remote system, no password necessary

ssh-agent is described well on the .net, for example here:

Another advantage of ssh-agent is that if you login to the remote system with ssh -A user@domain.name you can further ssh from the domain.name computer to a third computer containing your public key without every copying you private key to the domain.name computer (and it never sees your private key, only the one-time challenge/response).

John S Gruber
  • 13,248
  • 3
  • 37
  • 64
Floyd
  • 1,731
  • 1
  • 14
  • 16
  • How can I do that? It's not clear from the instructions that you sent. Moreover is this Ubuntu related? – pl1nk Jun 04 '12 at 14:27
  • I've edited my post with detailed instruction – Floyd Jun 05 '12 at 07:13
  • Your solution stores the password per session, additionally in my case seems that was a conflict with gnome-keyring as you can see in my answer. – pl1nk Jun 07 '12 at 09:38
  • @pl1nk: so you need the password to be stored across sessions - i.e., asked *only once* for each boot? – ish Jun 08 '12 at 02:49
  • yes, you have to provide the password once per session. This is the whole idea behind password protected ssh keys, to provide another layer of security beyond being able to access the private key file after login. – Floyd Jun 08 '12 at 05:57
  • @Floyd - Well as I mentioned already (to Syzygy), do you always type all of your passwords ? The point of this question is how to make it so that one doesn't need to enter the password for the key in every session. – pl1nk Jun 08 '12 at 08:47
2

If you are using Unity, or a session manager that starts gnome-keyring-daemon, you can simply use Seahorse (Passwords and Keys) to establish a key, define what it is for, set a passphrase, and distribute its public key to the computer you are going to use with ssh. No terminal commands are necessary.

You create the password by:

  1. selecting File->New and select Secure Shell Key. Press Continue.

  2. Type in a descriptive name, and select Create and set up.

  3. You will be prompted to enter a keyphrase twice (the second time to check that you didn't mis-enter it the first time.

  4. Enter the computer to which the public key should be used and the user name on that computer for which you will be using the key. The public key will be copied to that other computer, prompting for your password on that computer if necessary.

Now the My Personal Keys tab will display the key.

Assuming gnome-keyring-daemon was started properly when you logged into Lightdm, and again by your session manager, when you first use the key with ssh you will be prompted for the keyphrase. In this dialog box you can provide the keyphrase, select the Details control and ask that the keyring be unlocked whenever you are logged in--automatically providing this key. Press OK

You may not be prompted in this way if there is another key available for logging into the remote computer.

After this has been accomplished the first Seahorse tab Passwords will list an "Unlock password entry" for the key name. Click on the triangle before "Passwords: Login" to see it.

John S Gruber
  • 13,248
  • 3
  • 37
  • 64
  • So this functionality it's not working with Awesome WM I would like to continue using Awesome so I will keep using my workaround. – pl1nk Jun 13 '12 at 00:47
-1

you can use

ssh-add 'filename or fullpath'

you will be asked for the passphrase if yout key have one

then you can connect with out password

eyadof
  • 1,474
  • 1
  • 16
  • 17
-2

If you want to work with private keys do:

ssh-keygen -t rsa -N ''

Then:

copy .ssh/id_rsa.pub to machine destination in .ssh/authorized_keys via scp

scp .ssh/id_rsa.pub user@remote_machine:~/.ssh/authorized_keys

All done.

Connect to remote machine without password:

ssh user@remote_machine

And we don't have password prompt.

Octávio Filipe Gonçalves
  • 15,465
  • 4
  • 21
  • 23
  • This will keep asking me for the key password every time. – pl1nk May 18 '12 at 12:37
  • 1
    Probably because when you run ssh-keygen -t rsa -N '', you put a password. So when you run the above command, don't put a password, only press "ENTER" key. – Octávio Filipe Gonçalves May 18 '12 at 12:38
  • Well I would like to have keys with password. I updated my question – pl1nk May 18 '12 at 12:50
  • 1
    Ok, i don't figure out why you want to do this with password. Normally this concept is used only to make connections with remote machines that can recognize the Client machine without authentication. So, if don't want this scenario, you only have to do is execute a normal ssh connection. right? – Octávio Filipe Gonçalves May 18 '12 at 12:53
  • You should re-read my question. It's not about connecting to a ssh host without password, but how can I add a password protected key to a session without being prompted every time about the password. ssh-add is a solution but I'm searching for a more elegant way to do this. – pl1nk May 18 '12 at 13:05
  • 1
    Telling people to copy their public key over the authorized_keys on a remote machine is a bit brute force... Much better is to used the ssh-copy-id user@remotemachine command, which will as for a password login the first time and then APPEND not overwrite the key. – Floyd Jun 04 '12 at 14:22