slight issue with ssh-keys

Question

quite new to the forum. Currently I have two machines running a MacBook and an RPi3 running Arch Linux Arm. I have set up hosts files and ssh keys so that I can easily ssh from one machine into the other, for example ssh m147@RPi from my Mac and ssh m147@phi from my RPi3.

Right now I have set up my keys with the default name of id_rsa and id_rsa.pub (which I also use for other things like github). I did ...

cat ~/.ssh/id_rsa.pub | ssh m147@RPi 'cat >> .ssh/authorized_keys'

to copy the public key to the other machine and vice versa. So far so good. However, I have also encrypted both keys on both machines with a passphrase. Going from Mac to RPi is no problem because macOS stores the passphrase in the keychain and so I don't need to enter the passphrase every time I want to ssh into RPi. But the opposite is not the case and I an asked for the passphrase when ssh'ing into Mac from RPi. I like having the added security of the passphrase when using github but I don't really need it for local ssh'ing between my two machines. What I thought was I could set up a second set of keys (I called it local_ssh/local_ssh.pub) and use those just for ssh'ing locally. I did the exact same process as with the id_rsa keys but it doesn't seem to work. Even with the local_ssh.pub key copied to mac authorized_keys it still requires me to enter the mac password when ssh'ing into it. What am I missing. Apologies if this post is a little convoluted.

Answer 1

I don't recommend creating a second pair of keys, without passphrase for local connections, because that would compromise the security of your Mac account.

I recommend to use an ssh-agent on the RPi to cache the passphrase so that you only have to enter once per session. This is as simple as running these commands once per shell:

eval $(ssh-agent)
ssh-add

The first command starts ssh-agent, which outputs some environment variables that the shell will need to connect to the agent, something like this:

SSH_AUTH_SOCK=/tmp/ssh-zORhQbMJOFoH/agent.21166; export SSH_AUTH_SOCK;
SSH_AGENT_PID=21167; export SSH_AGENT_PID;
echo Agent pid 21167;

The eval call executes those lines, so that the current shell can connect to the agent.

The second command adds the private key at the default location (usually ~/.ssh/id_rsa) to the agent. The agent will ask for the passphrase of the private key, to store in memory so you don't have to enter it again.

After this you can use the private key without passphrase, until the shell ends.

You can stop the agent with:

ssh-agent -k

---

To make sure you don't forget to stop the agent when exiting the session, you can create a trap:

trap 'eval $(ssh-agent -k)' EXIT

If you want to run these commands every time when you login to the RPi, you can add them to one of the startup scripts that is sourced by interactive shells, probably ~/.profile or ~/.bash_profile, depending on your operating system and your setup.

---

Note that the above simple technique will start a new ssh-agent for every shell. That is, every time you login to the RPi, it will start a new agent, and you will have to re-enter the passphrase. If you want something more persistent, for example keep a single ssh-agent as long as the RPi is running (as opposed to a single login session), then you need something a bit more sophisticated. For example, you could save the output of the ssh-agent command in a file (I use ~/.ssh/env), source it at the beginning of the shell, check if the agent referenced by the variables is actually running, and restart it as needed. Let me know if you need help with that.

Answer 2

I don't know what version of macOS you are using, but I used to use a key with a passphrase, which the Mac ignored (or defaulted from keychain) when connecting to the Pi, (probably incorrectly) but this no longer worked in recent macOS.

I created a new set of keys, without passphrase, which I use only on my local network.

I use totally separate keys for github called github_rsa.pub and external networks. Sharing keys is little different from using identical passwords for many logins.