Slashdot Mirror
Set up SSH Agent on Login
mpf writes "This is a simple procedure to allow you to be prompted at login for your SSH passphrase and have it optionally stored in your Mac OS X Keychain, so you'll never have to enter your passphrase again! It allows you to use ssh from AppleScripts and other non-interactive applications without entering your passphase." Nice idea. It combines two pieces of software, one that starts ssh-agent on login, and one that gets called to provide your ssh passphrase when needed (which can store/retrieve it in the Keychain). There's a small AppleScript to call ssh-add on login, to tie it all together.
SSH can use several forms of authentication, including public key cryptography. You use a password to encrypt your private key, which you supply on login.
Once your private key is decrypted, SSH can use it to authenticate you on any site that uses your public key for authentication.
There is security at every step. You typically have to be logged in as yourself (or root) to read your private key, you have to supply a password to decrypt the key, and you can remove they key from memory at any time.
Hmm mostly *but not entirely* , a bad idea, IMO.
This is useful as long as you remeber to lock your screen when you are away from your keyboard.
But to be honest, I wouldn't count on that. (as even doing that is not sufficent)
If you store your passwords on your machine and permit programs to access your keychain (which stores them encrypted but *outputs* them as plain text), a malacious program could steal all your account passwords without you knowing (which is of course much worse than just stealing the password to your desktop).
If you make sure the Keychain prompted you before allowing applications to access the Keychain, then that would be all well and good, but then that would elimiate most of the useful functionality of this method (as it would be more annoying than simply having to type in a password in the first place, as it would involve a hand leaving the keyboard and going for the mouse/trackball to point and click).
Even making Terminal.app the only application which can access passwords on the Keychain without prompting does not work around this problem as it's trivial to call the Terminal and get it to do stuff (and, infact some installers do).
In my experience, I have enough problems convincing lusers not to save their passwords in clear text in CRT/SecureCRT login scripts.
I don't wish to detract from someone's work, but this seems like someone's excuse not to have to remeber passwords.
(If there are a lot of systems to look after and you can't possibly remeber the passwords for all of them (and your not able to use something like NIS/LDAP), a plain text/CSV and something like Cypher is probably a better bet.)
so what you are saying is when your laptop is stolen, you are completely covered? i think not.
I don't think this is so much a password-free login as single sign-on. The keychain database is unlocked when the user logs in, and from then on, any applications which have been allowed to use it can get their registered passwords from the database, without having to ask the user.
Some people like single sign-on, others don't. Personally, I like its convenience. I think it should be done correctly, the database should, for instance, be relocked when the screen is locked, but it's a good solution for users, if used carefully.
using keygen to generate a identity and identity.pub in your local .ssh directory, then copying that identity.pub to the remote server in a ~/.ssh/authorized_keys (perm 644) file?
While that method also assumes physical security, I don't really worry about that. My iBook secures the screen if I'm idle for more than 5 minutes and I have a sleep corner. I don't leave my desk without using the sleep corner to lock up.
I know a lot of people that use this, the trick is to keep the identity file secure. That's your private key and needs to be safe.
-- There is no sig line, only Zuul.
He meant private key of course. The public key is readable by world and installed on the server side. It's the private key that's encrypted with your passphrase.
In response to BigBir3d:
He didn't say that at all.
In response to AC:
BigBir3d's point was that once someone gets ahold of your private - albeit encrypted - ssh key, they can bruteforce your passphrase. PKI is only as secure as your keys (length/phrase/security[ie, Do You Know Where Your Private Keys Are?])
--
My comments and opinions completely reflect those of anyone and anything I am remotely associated with.
At the end of the day, it's all about managing risk. So, you have to take the proper safeguards in order to balance your convenience.
Sujal
politics, food, music, life: FatMixx
Yes, you very well covered if your laptop gets stolen, as long as the power's off. The only copy of your private key is on the hard disk, and your passphrase is required to use it, because it's encrypted.
If your laptop is stolen while powered on with an active login session, you may be screwed.
Essentially it goes:
Remote machine: At the request of user bar, I will permit any machine that can prove it has private key foo to log in as user bar.
Local machine: If user bar (or baz) supplies the password for key foo, I can decrypt it. If I can decrypt key foo, I will use it to log into the remote machine.
So in fact, the remote machine doesn't trust your local machine, it trusts the key.
The only decrypted copy of the key is in memory. If you're really unlucky, it got swapped to disk, and was recovered by the person who stole your laptop. Recovering a key like this is nontrivial to do, but not impossible.