Automating ssh-agent/ssh-add

[Tony Walker_2]

Hi Guys,

I'm attempting to setup automatic ssh agency using the good old snail book. At present, I have the user runing ksh. The .profile runs
#ssh-agent $SHELL $HOME/.profile2.

$HOME/.profile2 contains a .shrc call and the .shrc performs the ssh-add.

When I log in, I'm prompted to enter my passphrase (ssh-add) but when I do the entire shell seems to close and I'm back to the original login shell. Can anyone point me in the right direction?

Thanks,

Tony

[Steven E. Protter]

Is the goal password free ssh?

If so, read the doc I'm attaching. If not, I don't understand the goal and you may wish to clarify.

SEP

[Tony Walker_2]

Stephen,

Thanks. I have already configured the host based authentication but am now experimenting with enforcing a passphrase for the key generation. To take the anoyance of typing it in for each ssh operation I want to start an ssh-agent and add an identity as soon as a user logs in (Chap 6 in the O'Reily book).

Tony

[Ermin Borovac]

You can try placing the following commands in $HOME/.profile (insert full paths to ssh-agent and ssh-add).

eval `ssh-agent`
ssh-add

[Sridhar Bhaskarla]

Tony,

A little trick. Create a script say 'mysshadd' with the following:

ssh-agent > /home/user/.ssh/ssh-agent.conf
chmod 600 /home/user/.ssh/ssh-agent.conf
. /home/user/.ssh/ssh-agent.conf
ssh-add /home/user/.ssh/id_dsa
echo "Run . /home/user/.ssh/ssh-agent.conf now"


First time, run this script and it will prompt for the passphrase. Once it is done it will be copied into memory. Put the following line in your .profile

. /home/user/.ssh/ssh-agent.conf

Subsequent windows you open will use the ssh-agent started in the first session.

-Sri

[Tony Walker_2]

Ermin, Sridha,

I have already got this working fine with the single-shell method but I specificall want to use the sub-shell method as discussed in the book.

Cheers,

Tony

[Sridhar Bhaskarla]

Tony,

That's not for single shell. You run 'mysshadd' only in the first shell and startup ssh-agent. For rest of the sessions, you simply 'source in' ssh-agent.conf. It won't ask you for password because you don't really run 'ssh-add' later. Try it and see if it is not what you wanted.

-Sri

[Ermin Borovac]

You can try dropping $HOME/.profile2 from ssh-agent invocation (also add exec).

Put the following at the end of your $HOME/.profile.

ENV=$HOME/.shrc; export ENV
exec ssh-agent $SHELL

And in your $HOME/.shrc have

ssh-add

On exit from the shell ssh-agent will be terminated.

[David_779]

If you need to use passphrases (or want to), check out "keychain". "keychain" makes the ssh-agent/passphrase stuff pretty convenient.

http://www-106.ibm.com/developerworks/library/l-keyc.html

Then, when you add the following to your ".profile", you'll be asked to enter your passphrase. You won't need to enter your passphase untill the machine is rebooted. (Note: $USERLOCAL should be replaced with whatever directory the keychain stuff located.)

$USERLOCAL/keychain-2.4.2.1/keychain id_rsa
host=`uname -n`
[ -f $HOME/.keychain/$host-sh ] && \
. $HOME/.keychain/$host-sh

[SPO Distributed Svcs]

This is a snippet of script that I have in my .profile that has worked well for me. I don't know how I came by it, but it has been reliable under ksh on solaris. You will have to change the paths for all of the binaries to match your version of ssh ( HPUX version will install under /opt/... rather then /usr/local/.
I think the reason that your ssh-agent dies is because ssh-agent needs to be run as "eval ssh-agent..." and not just executed.

# Make sure ssh-agent1 and ssh-agent2 die on logout
trap '
test -n "$SSH_AGENT_PID" && eval `/usr/local/bin/ssh-agent -k` ;
test -n "$SSH2_AGENT_PID" && kill $SSH2_AGENT_PID
' 0

# If no agent is running and we have a terminal, run ssh-agent and ssh-add.
# (For SSH2, change this to use SSH2_AUTH_SOCK, ssh-agent2 and ssh-add2.)
if [ "$SSH_AUTH_SOCK" = "" ]
then
eval `/usr/local/bin/ssh-agent`
/usr/bin/tty > /dev/null && /usr/local/bin/ssh-add
fi