Linux Security Cookbook

6.9. Authenticating Without a Password (Interactively)

Problem

You want to authenticate without typing a password or passphrase.

Solution

Use ssh-agent, invoking it within backticks as shown:

$ eval `ssh-agent`

Add your keys to the agent using ssh-add :

$ ssh-add
Enter passphrase for /home/smith/.ssh/id_dsa: ********

Then log in using public-key authentication and you won’t be prompted for a passphrase: [Recipe 6.4]

$ ssh -l remoteuser remotehost

Some Linux distributions automatically run ssh-agent when you log in under an X session manager. In this case just skip the ssh-agent invocation.

Discussion

The SSH agent, controlled by the programs ssh-agent and ssh-add, maintains a cache of private keys on your local (client) machine. You load keys into the agent, typing their passphrases to decrypt them. SSH clients (ssh, scp, sftp) then query the agent transparently about keys, rather than prompting you for a passphrase.

The invocation of ssh-agent might look a little odd with the eval and backticks:

$ eval `ssh-agent`

but it is necessary because ssh-agent prints several commands on the standard output that set environment variables when run. To view these commands for testing, run ssh-agent alone:

$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-XXNe6NhE/agent.13583; export SSH_AUTH_SOCK;
SSH_AGENT_PID=13584; export SSH_AGENT_PID;
echo Agent pid 13584;

and then kill it manually (kill 13584).^[2]

ssh-add, invoked with no command-line arguments, adds your default keys to the cache. To add a selected key, simply ...