07-09-2005
...a more secure method
The only issue with the above outlined process is that you now have a totally unencrypted private key laying around your hard drive, which is a security risk. So you should not always use this method of no password on the key, depending on other security factors, such as if your home directory is on an NFS exported directory within a large network, thus more vulnerable to attack.
Consider using ssh-agent. You can read about it in the online man or
www.openssh.org. In this case, you supply a password when you generate your keys. I.e., when you do the
ssh-keygen -t rsa command, don't simply hit enter twice, but actually enter a password when it prompts you for one. This will encrypt your private key, and to be able to use it you need to specify the password. But here is the cool thing: with ssh-agent, you only need to enter the password once per login session, and ssh-agent lets you reuse the key with no pawword authentication for the rest of that session. Thus you enter the key's password once, and then you can do ssh, scp, and sftp without any password authentication whatsoever.
(The entire process is real easy to do. For step by step instructions, see
http://www.cc.gatech.edu/cns/software/ssh-agent.html.)
Last edited by hadarot; 07-09-2005 at 06:16 PM..
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
I have the problem with SFTP; BELOW IS the entry from my ssh_config file
It's prompting me for password all the time when using SFTP. pLEASE help. (1 Reply)
Discussion started by: dsravan
1 Replies
2. Programming
Hi,
I have set up my remote server for password-less login via ssh. If I run the command on my server - ssh user@remoteserver "ls -l"
I get an output, but when I try to do this via java
String sCmd = new String{"/usr/bin/ssh", " user@remoteserver", "\"ls -l\""};
Process p =... (3 Replies)
Discussion started by: nrworld
3 Replies
3. UNIX for Advanced & Expert Users
I am trying to copy a file from remote machine using scp. I followed the steps to configure public/private key usage. But still prompting for password when I do ssh.
I did the following steps to configure scp without asking password
Step 1 : local host > ssh-keygen -t rsa and when prompted... (9 Replies)
Discussion started by: satish@123
9 Replies
4. Red Hat
There are two servers :
1. Site
2. Testing
from site server i want to connect testing server with ssh password less authentication.
i generated public and private keys with ssh-keygen -t rsa on site server.
cat id_rsa >> authorized_keys
cat id_rsa.pub >> authorized_keys
i... (15 Replies)
Discussion started by: rehantayyab82
15 Replies
5. UNIX for Dummies Questions & Answers
Hello,
I'm trying to perform these operations without entering any password, as user "fzd":fzd@machine1> scp /tmp/srcFile1 fzd@machine2:/tmp/$destFile
fzd@machine1> scp fzd@machine2:/tmp/$srcFile /tmp/$destFilebut alsofzd@machine1> scp /tmp/srcFile1 machine2:/tmp/$destFile
fzd@machine1> scp... (6 Replies)
Discussion started by: fzd
6 Replies
6. Shell Programming and Scripting
Hi,
I have SVN installed in my UNIX solaris server.
I actually automated the process that downloads code from SVN server to UNIX solaris server in script. When i run the script, its asking for password to download every element.
Its really difficult to type password for every element when... (3 Replies)
Discussion started by: gthangav
3 Replies
7. Shell Programming and Scripting
Hi,
When i am trying to connect to other server using ssh coomand, it is prompting for password.
But i want to hardcode it with username so that it should not prompt for password.
And i dont want to use "ssh-keygen" method as it is not allowed.
Please help me.
Regards,
Mukta (7 Replies)
Discussion started by: Mukta
7 Replies
8. Shell Programming and Scripting
Hi All,
I am trying to transfer a file from one server to a remote server using SFTP. Client is not ready for key setup.
I am working on Solaris 10.
Here is the code.
#!/bin/ksh
# sample automatic Sftp script to dump a file
USER="user1"
PASSWORD="pass1"
HOST="host1"
sftp $USER@$HOST... (6 Replies)
Discussion started by: megha2525
6 Replies
9. UNIX for Dummies Questions & Answers
Dear unix experts,
i have a requirement as below.
i need to use SFTP as FTP.
ftp -n -v << ENDFTP
open test_ftp.server
user ftp_user_name ftp_password
quit
ENDFTP
if i use this in a shell script, it's not asking for password. But i want the similar thing achived using... (5 Replies)
Discussion started by: AraR87
5 Replies
10. Shell Programming and Scripting
// Red Hat Enterprise Linux Server release 6.7
I wanted to pass the password, but when I execute this cron, it stops at Password: prompt.
Please advise on how to fix the error. Thank you for tour help in advance.
#!/usr/bin/ksh
su - pmserver
echo "su - pmserver"
cd... (2 Replies)
Discussion started by: Daniel Gate
2 Replies
LEARN ABOUT LINUX
ssh-add
SSH-ADD(1) BSD General Commands Manual SSH-ADD(1)
NAME
ssh-add -- adds private key identities to the authentication agent
SYNOPSIS
ssh-add [-cDdLlXx] [-t life] [file ...]
ssh-add -s pkcs11
ssh-add -e pkcs11
DESCRIPTION
ssh-add adds private key identities to the authentication agent, ssh-agent(1). When run without arguments, it adds the files ~/.ssh/id_rsa,
~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/identity. After loading a private key, ssh-add will try to load corresponding certificate informa-
tion from the filename obtained by appending -cert.pub to the name of the private key file. Alternative file names can be given on the com-
mand line.
If any file requires a passphrase, ssh-add asks for the passphrase from the user. The passphrase is read from the user's tty. ssh-add
retries the last passphrase if multiple identity files are given.
The authentication agent must be running and the SSH_AUTH_SOCK environment variable must contain the name of its socket for ssh-add to work.
Any keys recorded in the blacklist of known-compromised keys (see ssh-vulnkey(1)) will be refused.
The options are as follows:
-c Indicates that added identities should be subject to confirmation before being used for authentication. Confirmation is performed by
the SSH_ASKPASS program mentioned below. Successful confirmation is signaled by a zero exit status from the SSH_ASKPASS program,
rather than text entered into the requester.
-D Deletes all identities from the agent.
-d Instead of adding identities, removes identities from the agent. If ssh-add has been run without arguments, the keys for the default
identities will be removed. Otherwise, the argument list will be interpreted as a list of paths to public key files and matching
keys will be removed from the agent. If no public key is found at a given path, ssh-add will append .pub and retry.
-e pkcs11
Remove keys provided by the PKCS#11 shared library pkcs11.
-L Lists public key parameters of all identities currently represented by the agent.
-l Lists fingerprints of all identities currently represented by the agent.
-s pkcs11
Add keys provided by the PKCS#11 shared library pkcs11.
-t life
Set a maximum lifetime when adding identities to an agent. The lifetime may be specified in seconds or in a time format specified in
sshd_config(5).
-X Unlock the agent.
-x Lock the agent with a password.
ENVIRONMENT
DISPLAY and SSH_ASKPASS
If ssh-add needs a passphrase, it will read the passphrase from the current terminal if it was run from a terminal. If ssh-add does
not have a terminal associated with it but DISPLAY and SSH_ASKPASS are set, it will execute the program specified by SSH_ASKPASS and
open an X11 window to read the passphrase. This is particularly useful when calling ssh-add from a .xsession or related script.
(Note that on some machines it may be necessary to redirect the input from /dev/null to make this work.)
SSH_AUTH_SOCK
Identifies the path of a UNIX-domain socket used to communicate with the agent.
FILES
~/.ssh/identity
Contains the protocol version 1 RSA authentication identity of the user.
~/.ssh/id_dsa
Contains the protocol version 2 DSA authentication identity of the user.
~/.ssh/id_ecdsa
Contains the protocol version 2 ECDSA authentication identity of the user.
~/.ssh/id_rsa
Contains the protocol version 2 RSA authentication identity of the user.
Identity files should not be readable by anyone but the user. Note that ssh-add ignores identity files if they are accessible by others.
EXIT STATUS
Exit status is 0 on success, 1 if the specified command fails, and 2 if ssh-add is unable to contact the authentication agent.
SEE ALSO
ssh(1), ssh-agent(1), ssh-keygen(1), ssh-vulnkey(1), sshd(8)
AUTHORS
OpenSSH is a derivative of the original and free ssh 1.2.12 release by Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
Theo de Raadt and Dug Song removed many bugs, re-added newer features and created OpenSSH. Markus Friedl contributed the support for SSH
protocol versions 1.5 and 2.0.
BSD
October 28, 2010 BSD