I am using Azure DevOps for my pipeline. For testing purposes, I have created a variable $key to store the private key. I want to use that key to SSH to a remote server. When I try to write the $key to a file and then use it e.g.
ssh user#10.10.10.10 -i keyfile
I get asked for a passphrase. I believe that this is to do with the format of the private key file. It appears as a long string without line breaks.
What is the best way to format the string and write it to a .pem file?
If you want to make use of private keys, you should add your public key to .ssh/authorized_keys.
$ ssh-keygen -t rsa
$ cat ~/.ssh/id_rsa.pub | ssh you#server 'cat >> ~/.ssh/authorized_keys'
$ ssh -i ~/.ssh/id_rsa you#server
Please note that you should allow sshd to login via public key:
PubkeyAuthentication yes
If you can't change the settings on the server, you might want to make use of expect. It less secure, tho. Read this for more information.
Related
In ~/.ssh I have github and bitbucket private key files. Both are encrypted, so when I ssh-add ~/.ssh/github I have to enter a password.
I have a bash script to automate git commands. If the github and/or bitbucket identities have NOT been added yet, then I want to ssh-add them.
I'm looking for a function like:
has_identity_been_added ~/.ssh/github
To simply check if the private, encrypted key file has been added.
I found:
ssh-add -l prints out a string of text for each identity... and I don't know what it is, but it's not the key file name
ssh-add -L prints the public key, which I'm not storing on my local machine, so I'm not sure how to verify against it, without asking for the private key file's password again.
Both of those print the name I gave to the key file like reed#laptop-x1834 (I think that was the automatic name, cause I didn't specify -C in the ssh-keygen, if memory serves).
I'm not sure where to go from here. I don't want to rely upon the ssh-keygen -C "whatever_name".
ssh-add -l print out fingerprint of the keys added.
You can get the fingerprint of a public key with :
ssh-keygen -l -f id_rsa.pub
I can add pem files to my SSH agent very easily using ssh-add, like so:
$ ssh-add /home/jsmith/keys/mytest.pem
But I can't seem to remove them:
$ ssh-add -d /home/jsmith/keys/mytest.pem
Bad key file /home/jsmith/keys/mytest.pem: No such file or directory
The pem file still exists though... I haven't moved or changed it in any way. Why am I having so much trouble removing this pem file from my SSH agent that I just added a moment ago? What's the correct way to do this?
I want to avoid using ssh-add -D (with a capital "D") because that would delete all of the identities from my SSH agent, and I only want to delete the one I've specified.
You have to use the public key for this. So first extract the public key and then remove it from the agent.
ssh-keygen -y -f /home/jsmith/keys/mytest.pem > /home/jsmith/keys/mytest.pub
ssh-add -d /home/jsmith/keys/mytest.pub
The man page mentions the "public" key as well: "if no public key is found at a given path, ssh-add will append .pub and retry".
The best alternative I've found is to re-add the same file but with a life-time of 1 second:
ssh-add -t 1 myfile.pem
It is easier to remember than extracting the public key.
If you know the comment associated with the key you can simply get the public key from the agent and pipe it back in to delete it.
ssh-add -L | grep -F 'test#example.com' | ssh-add -d -
I need to use a bash script to do the following:
generate public private key on NodeA
Copy the public key into a remote NodeB 's authorized_keys
Add NodeB to NodeA's known_hosts.
I need to do all this without a password prompt for ssh-ing into NodeB
In the second step I am even specifying the private key with "-i".
The following script I have now still asks for password
#!/bin/bash
sudo ssh-keygen -t rsa -N "" -f /root/.ssh/id_ccn_rsa
ssh -i /root/.ssh/id_ccn_rsa -o StrictHostKeyChecking=no $1
sudo sh -c "ssh-keyscan $1 >> /root/.ssh/known_hosts"
There is no magic.
To deploy the key you MUST be able to login without the key at least one time. Or have someone who can login and has root access deploy the public key for you.
You cannot login without a password and without a key unless your account was set up without a password AND sshd was configured with the non-default PermitEmptyPasswords yes option.
I was referring to http://www.mtu.net/~engstrom/ssh-agent.php
My public key is listed under ~/.ssh/authorized_keys at remote1. During SSH login connect,
it's working fine(loaded my private key under connection-Auth), it asked for passphrase which I provided then login is successful.
But when switching between servers like from remote2, do SSH remote1, it would ask for a password. Trying to set up SSH agent forwarding according to that site but was to no avail...ssh-add never prompts me for private-key-passphrase or was it wrong what i was doing trying to follow the process described?
I basically did
$ eval ssh-agent
$ ssh-add (some do ssh-add ~/.ssh/id_rsa--> wonder wat id_rsa is referring to as I only have the auth_keys file under .ssh)
Saw some resources described to do chmod 600 ~/.ssh/authorized_keys, but not sure if that's applicable to my case.
ssh-agent wrap another command, you can for example wrap a shell
ssh-agent bash
Then, in that shell, you need to add your private key, and type your passphrase :
ssh-add /path/to/your/private/key # (by default : ~/.ssh/id_rsa)
Then, when you use ssh to connect, add the -A option :
ssh -A user#remote1
That's it, your key is forwarded, you can see it if you type (on remote1) :
ssh-add -L
You can now connect to your remote2, using that private key.
Be careful when you use ssh forwarding. Anyone with root access on remote1 could use your identity to connect on remote2 while you are connected.
I am pretty sure that ~/.ssh/authorized_keys must always be chmod 600. This is a sensitive file that must be protected.
I just installed ubuntu and would like to set its rsa keys up with bitbucket/github. When I ssh-keygen the keys are generated as they should be
ssh-rsa AA...yBEz3pLL georgemauer#ubuntu
which is perfectly usable except the username part. In every rsa key I've generated previously, the username section read my email address:
ssh-rsa AA...yBEz3pLL gmylastname#gmail.com
No, it's not a major impediment but if I don't get this right it will drive me crazy. How, do I generate with rsa keys with an email username of my choice?
Use the -C option to provide a new comment with your key.
Explanation: In general, the last string in your ssh public key would be a single comment which in default configured to your user#host. You can override this comment by adding -C argument and edit this string.
For example In default behaviour, lets say that - if your linux hostname is Ubuntu and your user name is john.doe while you watch your public key performing cat ~/.ssh/id_rsa.pub you would see something like this:
ssh-rsa <someReallyBigToken>== john.doe#ubuntu
Documentation:
ssh-keygen will by default write keys in an OpenSSH-specific format.
This format is preferred as it offers better protection for keys at
rest as well as allowing storage of key
comments within the private key file itself. The key comment may be useful to help identify the key. The comment is initialized to
``user#host'' when the key is created, but
can be changed using the -c option.
Solution: override this comment and use -C argument for comment.
ssh-keygen -t rsa -b 4096 -C message-in-a-bottle
cat ~/.ssh/id_rsa.pub
// output:
ssh-rsa <someReallyBigToken>== message-in-a-bottle
ssh-keygen -t rsa -f ~/.ssh/[KEY_FILENAME] -C [USERNAME]
I use this command for generating the SSH key for generating GitHub, GitLab, and GCP.
Here is the documentation for creating an SSH key with a username.