topic Re: Automating ssh-agent/ssh-add in Operating System - HP-UX

Automating ssh-agent/ssh-add

Tony Walker_2 — Thu, 04 Nov 2004 11:15:33 GMT

Hi Guys,

I'm attempting to setup automatic ssh agency using the good old snail book. At present, I have the user runing ksh. The .profile runs
#ssh-agent $SHELL $HOME/.profile2.

$HOME/.profile2 contains a .shrc call and the .shrc performs the ssh-add.

When I log in, I'm prompted to enter my passphrase (ssh-add) but when I do the entire shell seems to close and I'm back to the original login shell. Can anyone point me in the right direction?

Thanks,

Tony

Re: Automating ssh-agent/ssh-add

Steven E. Protter — Thu, 04 Nov 2004 11:19:46 GMT

Is the goal password free ssh?

If so, read the doc I'm attaching. If not, I don't understand the goal and you may wish to clarify.

SEP

Re: Automating ssh-agent/ssh-add

Tony Walker_2 — Thu, 04 Nov 2004 11:24:38 GMT

Stephen,

Thanks. I have already configured the host based authentication but am now experimenting with enforcing a passphrase for the key generation. To take the anoyance of typing it in for each ssh operation I want to start an ssh-agent and add an identity as soon as a user logs in (Chap 6 in the O'Reily book).

Tony

Re: Automating ssh-agent/ssh-add

Ermin Borovac — Thu, 04 Nov 2004 20:04:44 GMT

You can try placing the following commands in $HOME/.profile (insert full paths to ssh-agent and ssh-add).

eval `ssh-agent`
ssh-add

Re: Automating ssh-agent/ssh-add

Sridhar Bhaskarla — Thu, 04 Nov 2004 20:32:29 GMT

Tony,

A little trick. Create a script say 'mysshadd' with the following:

ssh-agent > /home/user/.ssh/ssh-agent.conf
chmod 600 /home/user/.ssh/ssh-agent.conf
. /home/user/.ssh/ssh-agent.conf
ssh-add /home/user/.ssh/id_dsa
echo "Run . /home/user/.ssh/ssh-agent.conf now"

First time, run this script and it will prompt for the passphrase. Once it is done it will be copied into memory. Put the following line in your .profile

. /home/user/.ssh/ssh-agent.conf

Subsequent windows you open will use the ssh-agent started in the first session.

-Sri

Re: Automating ssh-agent/ssh-add

Tony Walker_2 — Fri, 05 Nov 2004 04:07:58 GMT

Ermin, Sridha,

I have already got this working fine with the single-shell method but I specificall want to use the sub-shell method as discussed in the book.

Cheers,

Tony

Re: Automating ssh-agent/ssh-add

Sridhar Bhaskarla — Fri, 05 Nov 2004 10:35:12 GMT

Tony,

That's not for single shell. You run 'mysshadd' only in the first shell and startup ssh-agent. For rest of the sessions, you simply 'source in' ssh-agent.conf. It won't ask you for password because you don't really run 'ssh-add' later. Try it and see if it is not what you wanted.

-Sri

Re: Automating ssh-agent/ssh-add

Ermin Borovac — Sun, 07 Nov 2004 18:22:11 GMT

You can try dropping $HOME/.profile2 from ssh-agent invocation (also add exec).

Put the following at the end of your $HOME/.profile.

ENV=$HOME/.shrc; export ENV
exec ssh-agent $SHELL

And in your $HOME/.shrc have

ssh-add

On exit from the shell ssh-agent will be terminated.

Re: Automating ssh-agent/ssh-add

David_779 — Mon, 15 Nov 2004 13:54:55 GMT

If you need to use passphrases (or want to), check out "keychain". "keychain" makes the ssh-agent/passphrase stuff pretty convenient.

http://www-106.ibm.com/developerworks/library/l-keyc.html

Then, when you add the following to your ".profile", you'll be asked to enter your passphrase. You won't need to enter your passphase untill the machine is rebooted. (Note: $USERLOCAL should be replaced with whatever directory the keychain stuff located.)

$USERLOCAL/keychain-2.4.2.1/keychain id_rsa
host=`uname -n`
[ -f $HOME/.keychain/$host-sh ] && \
. $HOME/.keychain/$host-sh

Re: Automating ssh-agent/ssh-add

SPO Distributed Svcs — Mon, 15 Nov 2004 16:21:53 GMT

This is a snippet of script that I have in my .profile that has worked well for me. I don't know how I came by it, but it has been reliable under ksh on solaris. You will have to change the paths for all of the binaries to match your version of ssh ( HPUX version will install under /opt/... rather then /usr/local/.
I think the reason that your ssh-agent dies is because ssh-agent needs to be run as "eval ssh-agent..." and not just executed.

# Make sure ssh-agent1 and ssh-agent2 die on logout
trap '
test -n "$SSH_AGENT_PID" && eval `/usr/local/bin/ssh-agent -k` ;
test -n "$SSH2_AGENT_PID" && kill $SSH2_AGENT_PID
' 0

# If no agent is running and we have a terminal, run ssh-agent and ssh-add.
# (For SSH2, change this to use SSH2_AUTH_SOCK, ssh-agent2 and ssh-add2.)
if [ "$SSH_AUTH_SOCK" = "" ]
then
eval `/usr/local/bin/ssh-agent`
/usr/bin/tty > /dev/null && /usr/local/bin/ssh-add
fi