2

quite new to the forum. Currently I have two machines running a MacBook and an RPi3 running Arch Linux Arm. I have set up hosts files and ssh keys so that I can easily ssh from one machine into the other, for example ssh m147@RPi from my Mac and ssh m147@phi from my RPi3.

Right now I have set up my keys with the default name of id_rsa and id_rsa.pub (which I also use for other things like github). I did ...

cat ~/.ssh/id_rsa.pub | ssh m147@RPi 'cat >> .ssh/authorized_keys'

to copy the public key to the other machine and vice versa. So far so good. However, I have also encrypted both keys on both machines with a passphrase. Going from Mac to RPi is no problem because macOS stores the passphrase in the keychain and so I don't need to enter the passphrase every time I want to ssh into RPi. But the opposite is not the case and I an asked for the passphrase when ssh'ing into Mac from RPi. I like having the added security of the passphrase when using github but I don't really need it for local ssh'ing between my two machines. What I thought was I could set up a second set of keys (I called it local_ssh/local_ssh.pub) and use those just for ssh'ing locally. I did the exact same process as with the id_rsa keys but it doesn't seem to work. Even with the local_ssh.pub key copied to mac authorized_keys it still requires me to enter the mac password when ssh'ing into it. What am I missing. Apologies if this post is a little convoluted.

  • you need to change the ssh command you are using to connect to the mac and add the -i flag, alternatively you could create a ~/.ssh/config file cyberciti.biz/faq/create-ssh-config-file-on-linux-unix – Steve Robillard Dec 25 '17 at 8:33
  • You also can store the key once opened like on your mac using ssh agent. I wrote a 6 part article on SSH for this site's blog raspberrypise.tumblr.com/post/150078167619/… parts 2 an 5 are especially relevant. – Steve Robillard Dec 25 '17 at 9:00
  • Thank you, that did it! Didn't even know about a personal ssh config file. Works great! Also, great article, I will bookmark it for sure. Lots of good info there – m147 Dec 25 '17 at 12:44
0

I don't recommend creating a second pair of keys, without passphrase for local connections, because that would compromise the security of your Mac account.

I recommend to use an ssh-agent on the RPi to cache the passphrase so that you only have to enter once per session. This is as simple as running these commands once per shell:

eval $(ssh-agent)
ssh-add

The first command starts ssh-agent, which outputs some environment variables that the shell will need to connect to the agent, something like this:

SSH_AUTH_SOCK=/tmp/ssh-zORhQbMJOFoH/agent.21166; export SSH_AUTH_SOCK;
SSH_AGENT_PID=21167; export SSH_AGENT_PID;
echo Agent pid 21167;

The eval call executes those lines, so that the current shell can connect to the agent.

The second command adds the private key at the default location (usually ~/.ssh/id_rsa) to the agent. The agent will ask for the passphrase of the private key, to store in memory so you don't have to enter it again.

After this you can use the private key without passphrase, until the shell ends.

You can stop the agent with:

ssh-agent -k

To make sure you don't forget to stop the agent when exiting the session, you can create a trap:

trap 'eval $(ssh-agent -k)' EXIT

If you want to run these commands every time when you login to the RPi, you can add them to one of the startup scripts that is sourced by interactive shells, probably ~/.profile or ~/.bash_profile, depending on your operating system and your setup.


Note that the above simple technique will start a new ssh-agent for every shell. That is, every time you login to the RPi, it will start a new agent, and you will have to re-enter the passphrase. If you want something more persistent, for example keep a single ssh-agent as long as the RPi is running (as opposed to a single login session), then you need something a bit more sophisticated. For example, you could save the output of the ssh-agent command in a file (I use ~/.ssh/env), source it at the beginning of the shell, check if the agent referenced by the variables is actually running, and restart it as needed. Let me know if you need help with that.

  • Why wouldn't it be safe? From what I understand, of course I could be wrong, my knowledge in this matter is still limited, it would use ssh key authentication with an rsa 4096 encryption only wouldn't have the added security of encrypted keys with a passphrase in case the private key is ever stolen from my computers. So anybody else not holding the public key wouldn't be able to connect without a password anyway. Is that not the case? – m147 Dec 25 '17 at 12:57
  • @m147 if the RPi gets hacked, the attacked would gain access to your Mac without a passphrase – Stop ongoing harm to Monica Jan 2 '18 at 20:33
0

I don't know what version of macOS you are using, but I used to use a key with a passphrase, which the Mac ignored (or defaulted from keychain) when connecting to the Pi, (probably incorrectly) but this no longer worked in recent macOS.

I created a new set of keys, without passphrase, which I use only on my local network.

I use totally separate keys for github called github_rsa.pub and external networks. Sharing keys is little different from using identical passwords for many logins.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.