Manage SSH Key File With Passphrase

Manage SSH Key File With Passphrase

Any serious DevOps will only ssh by key file. Not with password, right? And mostly our powerful key file can unlock many critical envs. Have you ever uploaded your private key to other envs, like jumpbox? What if your key is magically stolen by hackers somehow?

Time to protect your sensitive ssh key by passphrase. And live with it, headache-free.

Manage SSH Key File With Passphrase


Original Article: http://dennyzhang.com/ssh_passphrase

Update Per Audience Feedback:

  • Thanks to Joshua Cornutt: When storing a private key on a server, I'd opt for a hardware option (HSM) since it's likely the key will need to be actively used and thus a passphrase can't be securely used (think automated use of a server-side private key) .

Cheat Sheet for impatient users. Recommend to read this post through, even for experienced users.

Name Summary
Load key file ssh-add ~/.ssh/id_rsa
Remove all loaded keys ssh-add -D
Whether it's encrypted grep "ENCRYPTED" id_rsa
Add/Change passphrase ssh-keygen -p -f id_dsa
Remove passphrase ssh-keygen -p -P $passwd -N "" -f id_rsa
Load key without prompt Check link: here

Add passphrase to existing ssh key

We can easily use ssh-keygen to add passphrase. This certainly gives us extra security benefit. Next, what's the impact of this change?

  • You never use your private key other than your computer. Right? If yes, nothing you need to worry. One tiny difference: you might be asked to input the passphrase once. Check all loaded keys by ssh-add -l.
  • In some cases, we might use key files to do passwordless login in remote servers. For example, ssh tunnel for port forwarding, ssh from jumpbox to other machines, etc. Then we have to make sure the key file is correctly loaded and recognized. Run ssh-add ./id_rsa, then input passphrase manually. This also can be done automatically. We will explain it shortly.
# Change file mode to allow overwrite
chmod 700 id_rsa

# Add passphrase to key file
ssh-keygen -p -f id_rsa

# Denny-mac:.ssh mac$ ssh-keygen -p -f id_rsa
# Key has comment 'id_rsa'
# Enter new passphrase (empty for no passp...
# Enter same passphrase again: 
# Your identification has been saved with ...

Load protected ssh key without prompt

Pity that ssh-add itself doesn't have native support for this[1]. Here is a workaround. A bit tricky, I admit.

# Specify your passphrase here
export YOUR_PASSPHRASE="XXX"

# Load protected key without prompt
echo "echo $YOUR_PASSPHRASE" > /tmp/mypass
chmod 700 /tmp/mypass
cat id_rsa| SSH_ASKPASS=/tmp/mypass ssh-add -

# Verify loaded certificate
ssh-add -l

Change passphrase for existing private key

Run below command. You will be asked to input old passphrase and new one. If the key is not encrypted, just press enter in the terminal.

ssh-keygen -p -f ~/.ssh/id_dsa

Remove passphrase

Use openssl to remove passphrase.[2] You will need to manually input old passphrase.

openssl rsa -in id_rsa -out id_rsa_new

Same can be done by ssh-keygen.[3] The amazing part is no required human intervene. Totally automated.

ssh-keygen -p -P "$OLDPASS" -N "" -f id_rsa

More Reading: Reverse SSH Tunnel: Export Your Mac Laptop To The Internet.

Footnotes:

[1] unix.stackexchange.com/questions/90853/how-can-i-run-ssh-add-automatically-without-password-prompt
[3] stackoverflow.com/questions/112396/how-do-i-remove-the-passphrase-for-the-ssh-key-without-having-to-create-a-new-ke
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
RHCS6: Mirror/unmirror a GFS2 volume
Viewed 3992 times since Sun, Jun 3, 2018
LOGROTATE – ARCHIWIAZACJA LOGÓW
Viewed 1007 times since Fri, Nov 30, 2018
Securing /tmp and shm partitions
Viewed 1460 times since Fri, May 15, 2020
What is OS Watcher Utility and How to use it for Database Troubleshooting ?
Viewed 24394 times since Thu, Jun 21, 2018
Linux Find Large Files
Viewed 1614 times since Mon, Oct 29, 2018
10 Linux nslookup Command Examples for DNS Lookup
Viewed 9147 times since Sun, Sep 30, 2018
RHEL: Building a custom kernel on RHEL 6
Viewed 1696 times since Sat, Jun 2, 2018
How to disable SSH cipher/ MAC algorithms for Linux and Unix
Viewed 21253 times since Fri, Aug 21, 2020
RHEL7: Create and configure LUKS-encrypted partitions and logical volumes to prompt for password and mount a decrypted file system at boot.
Viewed 5011 times since Mon, Aug 6, 2018
RHEL: ACLs basics
Viewed 2445 times since Sun, May 27, 2018