0

I'm not sure about what I'm asking because I'm not pretty sure how does all of this world works, but, I have a private Ubuntu 14.04 server installed using VirtualBox, that I use for development, without X server. So, it is in terminal-land.

I run my private server on the terminal (vboxmanage startvm), and connect to it with ssh. Inside the private server, I connect to my public server when I need using ssh again.

When I connect to my private server, or use ssh for any other thing, I have to type my key passphrase only once during a whole desktop session. I don't know who is responsible for that, but I think it is the gnome-keyring-daemon. But inside my private server, I have to type my passphrase each time I use my key (for connecting to the public server for instance). I don't want to use ssh-agent or ssh-add because I don't want to be prompt just for connecting to my private server, specifically if I have more than one passphrase-protected key. Also, it is the issue of having a ssh-agent instance on each new terminal session.

The gnome-keyring is already installed in my private server but I don't know how to "activate" it to manage my keys, and to avoid being prompted for my passphrase, each time I want to ssh-connect from within my private server to my public server (I have some scripts which connects to it multiple times in a single run).

Lastly, don't forget the private server has currently no desktop and I'm not up to install it.

1
  • IMO the best tools for what you want would be screen, or similar, and ssh-agent (ssh-add), these are the defacto command line tools for what you want.
    – Panther
    Oct 31, 2016 at 19:03

2 Answers 2

3

What you are actually looking for is an ssh-agent. This is what remembers the fact that you successfully unlocked your key with a passphrase and keeps it unlocked while you are logged in. There are a few different implementations, gnome-keyring provides one, though for headless servers you can more easily either call ssh-agent directly in your .bashrc, or use keychain which is an app that wraps ssh-agent and makes life much easier.

Keychain should be available via sudo apt-get install keychain or on Fedora (dnf), CentOS (yum), or Arch (pacman). Once you have it installed you can add a line like eval $(keychain --eval) to your .bashrc and it will start and keep only 1 instance of ssh-agent running for your user. If you add a key name after the --eval it will load the named key(s) the first time you login by prompting you for your passphrase(s) right away and then keep them tucked away.

You can see what keys are loaded with ssh-add -l and you can add a key with ssh-add ~/.ssh/keyname which will prompt you just once for the passphrase and then store it until you logout or keychain is stopped/kill. You can add a kill command to .bash_logout if you are worried about keeping your keys unlocked after you disconnect.

See the very nice site with some excellent links to how OpenSSH works and good examples, https://www.funtoo.org/Keychain and enjoy not typing your passphrase repeatedly.

2

You cannot use gnome-keyring in a headless environment. It is designed for GNOME and requires presenting a UI to ask for the passphrase.

You can, however, use ssh -A to connect to that server, and the local agent will be forwarded, so that you don't have to keep private keys on the server, and you won't have to re-type your passphrase every time you wish to connect from that server to another host (or you could just connect to those hosts from your local machine instead of the server, which would be more secure). This reduces security slightly, as you are providing a connection back to the ssh agent on your local host, so a vulnerable client or server could lead to your keys being compromised.

1
  • I've seen, in this answer (superuser.com/questions/141036/…) how to add the pam module for the gnome-keyring, but I don't know for sure which relationship has that PAM module to ssh commands or if gnome-keyring does something else; and I didn't fully understand the "no passphrase" comment neither. So, I didn't apply that changes.
    – ABu
    Oct 31, 2016 at 19:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .