Public key authentication has a lot of advantages for connecting to servers, particularly if it’s the only allowed means of authentication, reducing the chances of a brute force password attack to zero. However, it doesn’t solve the problem of having to type in a password or passphrase on each connection, unless you’re using a private key with no passphrase, which is quite risky if the private key is compromised.
Thankfully, there’s a nice supplement to a well-secured SSH key setup in the use of agents on trusted boxes to securely store decrypted keys per-session, per-user. Judicious use of an SSH agent program on a trusted machine allows you to connect to any server for which your public key is authorised by typing your passphrase to decrypt your private key only once.
SSH agent setup
ssh-agent program is designed as a wrapper for a shell. If you have a
private and public key setup ready, and you have remote machines for which your
key is authorised, you can get an idea of how the agent works by typing:
$ ssh-agent bash
This will prompt you for your passphrase, and once entered, within the context
of that subshell, you will be able to connect to authorised remote servers
without typing in the passphrase again. Once loaded, you can examine the
identities you have by using
ssh-add -l to see the fingerprints, and
-L for the public keys:
$ ssh-agent bash Enter passphrase for /home/user/.ssh/id_rsa: Identity added: /home/user/.ssh/id_rsa (/home/user/.ssh/id_rsa) $ ssh-add -l 2048 07:1e:7d:c4:8a:0e:bc:b0:74:40:71:49:7c:70:9c /home/user/.ssh/id_rsa (RSA) $ ssh-add -L ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+WvWXmVPx6UYB/uf+HTh1Y5zEVOmSeFfj6IC0fwN lELVoFco9qdM4cuh6E6UaDURezjLSiayKt237DFHMgK9Hp4QPgN3ZJ7f7mesH7EHRnpLcvt0Rl3k1I4 C6gConwmkPZj3ax/cr6DAI9v7Ggeo7YPdKYhntB4TCEZfXlfihF5Vh5A2Od8cCNqy5KFKsFaLoI8Gwr +ZC0CoxIoW6t5t6C/ZNRK2ojVwRWvp3nxcZsOzSdZJu3jcNHGSr0fxpdythRrOjzdDHgCiBuH+7mGKa tLewbchdj8AgdeCE410xDJkov+tQuGYXZQAOx+JzWgiDI0VzWZsaV2QuyEF4NyG/ /home/user/.ssh/id_rsa
You can set up your
.bashrc file to automatically search for accessible SSH
agents to use for the credentials for new connections, and to prompt you for a
passphrase to open a new one if it need be. There are very workable
instructions on GitHub for setting this up.
If you want to shut down the agent at any time, you can use
$ ssh-agent -k unset SSH_AUTH_SOCK; unset SSH_AGENT_PID; echo Agent pid 790 killed;
SSH agent forwarding
Where the configuration of the remote machine allows it, you can forward authentication requests made from the remote machine back to the agent on your workstation. This is handy for working with semi-trusted gateway machines that you trust to forward your authentication requests correctly, but on which you’d prefer not to put your private key.
This means that if you connect to a remote machine from your workstation
running an SSH agent with the following, using the
user@workstation:~$ ssh -A remote.example.com
You can then connect to another machine from
remote.example.com using your
private key on
user@remote:~$ ssh another.example.com
SSH agent authentication via PAM
It’s also possible to use SSH agent authentication as a PAM method for general
authentication, such as for