Slashdot Mirror

← Back to Stories (view on slashdot.org)

SSH Key Management Part 2

Posted by Hemos on from the making-secure dept.

LKH writes "The second part of Daniel Robbins' ssh key management articles is up at developer works. Daniel covers passphrase-less authentication using keychain."

2 of 109 comments (clear)

  1. Easier way? by Anonymous Coward · · Score: 4, Informative

    Debian's XDM will start X with ssh-agent if its installed....

    $ cat .xsession
    ...
    (ssh-add
    xterm -e ssh -X host1&
    xterm -e ssh -X -1 otherhost &)&
    ...
    exec pwm
    $

    the ssh-add will pop up ssh-askpass and then log you in to all your hosts. And since X was started using ssh-agent, you never have to type in your passwords or passphrase for the entire session.

    If your not using debian I think you can just run
    $ ssh-agent startx

    -Justin

  2. Re:Neat, but... by earlytime · · Score: 5, Informative

    Well, there's two sides to this.

    The keychain folks have apparently taken the "rsh isn't so bad" approach. rsh and its counterparts are insecure for many reasons, only one of those is cleartext password authentication. Other reasons include unrestricted pre-authenticated per-user sessions (.rhosts files), and the ease with which someone can set up these sessions ( echo $myhostip >> /root/.rhosts ). It's extremely convenient though.

    The other side is where you're coming from, that each and every session needs authentication. That's a fair stance, just inconvenient when you're making multiple connections.

    I prefer an in-between approach. Start ssh-agent on login, and do the ssh-add manually. Then you can feel comfortable that someone must learn your RSA/DSA private key passphrase to use your credentials, and also that you have the convenience of not having to retype passwords, again and again, once you've authenticated once in that login session.

    That's how the ssh folks designed the system to work, and I like that solution. You could also decrease your risk by requiring both RSA/DSA and passwords for authentication.

    --