How to automatically unlock private SSH key?

Question

I have generated an RSA public / private key pair using ssh-keygen. However, I am prompted to enter the password to unlock it the first time it is used each session. How can I automatically have it unlocked after login?

Even better: since this is running on an Ubuntu server, it would be great if it was never locked at all - that way the automated daemons that need it would not require manual intervention to use it.

Solution 1

I may be mistaken here, but it sounds like what you're trying to do is to not need to unlock your key every time it is used?

If that's the case, it seems like the easiest solution would be to just not create a passphrase while creating the key. i.e. run

ssh-keygen

and when it asks for a passphrase, just press enter twice. I apologize if this is too simplistic, but it's what I've always done when creating keys so I don't need to unlock them. Hope it helps!

Solution 2

For reusage of encrypted key use ssh-agent. It prints some output containing environment variables that you have to export. Then add keys with ssh-add.

You have to unlock your key only once until ssh-agent is running.

Comments

[Admin]

Possible duplicate: askubuntu.com/questions/36255/…

[Admin]

@root45: How is that a duplicate? It doesn't seem to be the same question at all.

[Admin]

You're both being asked to unlock your key file each time you SSH into a server. Sorry, they seemed to be very similar or the same to me, but maybe I'm misunderstanding one or the other or both.

[Paradiesstaub]

That is not that kind of thing that improves security. A user could just copy the private key and access the other computer(s) easily.

[greydet]

I agree with Paradiesstaub, this accepted answer present security vulnerabilities!

[jat255]

That's certainly true, but hopefully there is some sort of encryption on the disk or at least on /home/user. If not, I agree that it's a pretty significant vulnerability, but that's typically the tradeoff for convenience, no?