Slashdot Mirror
Set up SSH Agent on Login
mpf writes "This is a simple procedure to allow you to be prompted at login for your SSH passphrase and have it optionally stored in your Mac OS X Keychain, so you'll never have to enter your passphrase again! It allows you to use ssh from AppleScripts and other non-interactive applications without entering your passphase." Nice idea. It combines two pieces of software, one that starts ssh-agent on login, and one that gets called to provide your ssh passphrase when needed (which can store/retrieve it in the Keychain). There's a small AppleScript to call ssh-add on login, to tie it all together.
SSH can use several forms of authentication, including public key cryptography. You use a password to encrypt your private key, which you supply on login.
Once your private key is decrypted, SSH can use it to authenticate you on any site that uses your public key for authentication.
There is security at every step. You typically have to be logged in as yourself (or root) to read your private key, you have to supply a password to decrypt the key, and you can remove they key from memory at any time.
Hmm mostly *but not entirely* , a bad idea, IMO.
This is useful as long as you remeber to lock your screen when you are away from your keyboard.
But to be honest, I wouldn't count on that. (as even doing that is not sufficent)
If you store your passwords on your machine and permit programs to access your keychain (which stores them encrypted but *outputs* them as plain text), a malacious program could steal all your account passwords without you knowing (which is of course much worse than just stealing the password to your desktop).
If you make sure the Keychain prompted you before allowing applications to access the Keychain, then that would be all well and good, but then that would elimiate most of the useful functionality of this method (as it would be more annoying than simply having to type in a password in the first place, as it would involve a hand leaving the keyboard and going for the mouse/trackball to point and click).
Even making Terminal.app the only application which can access passwords on the Keychain without prompting does not work around this problem as it's trivial to call the Terminal and get it to do stuff (and, infact some installers do).
In my experience, I have enough problems convincing lusers not to save their passwords in clear text in CRT/SecureCRT login scripts.
I don't wish to detract from someone's work, but this seems like someone's excuse not to have to remeber passwords.
(If there are a lot of systems to look after and you can't possibly remeber the passwords for all of them (and your not able to use something like NIS/LDAP), a plain text/CSV and something like Cypher is probably a better bet.)
so what you are saying is when your laptop is stolen, you are completely covered? i think not.
The original sh compatible keychain tool for Linux (and Unix in general) mentioned in the referenced link can be found on the Gentoo Linux website here. There are links to IBM developerWorks articles describing the concepts behind the keychain scripts as well as how to set it up and use it.
Logic is not Divine.
I don't think this is so much a password-free login as single sign-on. The keychain database is unlocked when the user logs in, and from then on, any applications which have been allowed to use it can get their registered passwords from the database, without having to ask the user.
Some people like single sign-on, others don't. Personally, I like its convenience. I think it should be done correctly, the database should, for instance, be relocked when the screen is locked, but it's a good solution for users, if used carefully.
Um ... actually, this is making it more Unix-like (as if Unix can be made more Unix-like) ... on Mac OS 9 I have no way to set up an ssh-agent (although NiftyTelnet does cache your ssh passphrase in memory, and MacSSH can cache it in the Keychain). On Linux, when I log in to my graphical UI, I set up one ssh-agent for all my terminals etc. to use. It's the same thing. ssh is made for this. All this does is make it so the ssh-agent is started automatically and your key is added to it automatically, by using the Keychain. Sure, the Keychain or SSH could have security flaws in them, but is that's the case, there are far bigger problems than merely this.
using keygen to generate a identity and identity.pub in your local .ssh directory, then copying that identity.pub to the remote server in a ~/.ssh/authorized_keys (perm 644) file?
While that method also assumes physical security, I don't really worry about that. My iBook secures the screen if I'm idle for more than 5 minutes and I have a sleep corner. I don't leave my desk without using the sleep corner to lock up.
I know a lot of people that use this, the trick is to keep the identity file secure. That's your private key and needs to be safe.
-- There is no sig line, only Zuul.
He meant private key of course. The public key is readable by world and installed on the server side. It's the private key that's encrypted with your passphrase.
In response to BigBir3d:
He didn't say that at all.
In response to AC:
BigBir3d's point was that once someone gets ahold of your private - albeit encrypted - ssh key, they can bruteforce your passphrase. PKI is only as secure as your keys (length/phrase/security[ie, Do You Know Where Your Private Keys Are?])
--
My comments and opinions completely reflect those of anyone and anything I am remotely associated with.
At the end of the day, it's all about managing risk. So, you have to take the proper safeguards in order to balance your convenience.
Sujal
politics, food, music, life: FatMixx
I wrote a perl script that manages ssh-agent processes that gets executed in the .login. Basically the way it works is that whenever I start a terminal session it sets the proper environment variables if ssh-agent is running, otherwise, it starts ssh-agent (therefore asking for password). I also wrote some scripts to add my public key to remote hosts. I use SSHPassKey for ProjectBuilder, which seems to integrate with my system pretty well.
; ; .*?\ (.*?);\n$/$1/; .*?\ (.*?);\n$/$1/;
---
#!/usr/bin/perl
sub findpid {
$addkeys = shift;
open FILE,"$ENV{HOME}/.ssh/.ssh-agent.csh";
$sock =
$pid =
close FILE;
$sock =~ s/^.*?\
$pid =~ s/^.*?\
$lines = 0;
if ($pid) {
open PS,"/bin/ps -p $pid|";
;
while () { ++$lines; }
close PS;
}
if ($lines) {
$ENV{'SSH_AUTH_SOCK'} = $sock;
$ENV{'SSH_AGENT_PID'} = $pid;
if ($addkeys) {`ssh-add $ENV{HOME}/.ssh/identity $ENV{HOME}/.ssh/id_dsa`;}
} else {
print "Starting ssh-agent...\n";
`ssh-agent > $ENV{HOME}/.ssh/.ssh-agent.csh`;
findpid(1);
}
}
findpid();
Yes, you very well covered if your laptop gets stolen, as long as the power's off. The only copy of your private key is on the hard disk, and your passphrase is required to use it, because it's encrypted.
If your laptop is stolen while powered on with an active login session, you may be screwed.
Essentially it goes:
Remote machine: At the request of user bar, I will permit any machine that can prove it has private key foo to log in as user bar.
Local machine: If user bar (or baz) supplies the password for key foo, I can decrypt it. If I can decrypt key foo, I will use it to log into the remote machine.
So in fact, the remote machine doesn't trust your local machine, it trusts the key.
The only decrypted copy of the key is in memory. If you're really unlucky, it got swapped to disk, and was recovered by the person who stole your laptop. Recovering a key like this is nontrivial to do, but not impossible.
Of course, some OSes support encrypted swap. . .
I think you are confused. The article wasn't about bypassing login to the mac itself (that can easily be done in the Login system pref panel, on any osx mac), but rather bypassing passwords for remote systems. There is no way (that I know of at least) to get ssh keys working this elgantly in OS9.
I'm in and out of a couple different shell servers all day, so this is a huge timesaver for me. And it is pretty secure, because every time I close the lid of my ibook the system sleeps, and everytime the system sleeps, my keychain is locked. And I've got a password on my screensaver too. And I don't have my actual remote passwords stored. It's beautiful.
__
Choose mnemonic identifiers. If you can't remember what mnemonic means, you've got a problem. - Larry Wall