DZone
DevOps Zone
Thanks for visiting DZone today,
Edit Profile
  • Manage Email Subscriptions
  • How to Post to DZone
  • Article Submission Guidelines
Sign Out View Profile
  • Post an Article
  • Manage My Drafts
Over 2 million developers have joined DZone.
Log In / Join
  • Refcardz
  • Trend Reports
  • Webinars
  • Zones
  • |
    • Agile
    • AI
    • Big Data
    • Cloud
    • Database
    • DevOps
    • Integration
    • IoT
    • Java
    • Microservices
    • Open Source
    • Performance
    • Security
    • Web Dev
DZone > DevOps Zone > Manage SSH Key File With a Passphrase

Manage SSH Key File With a Passphrase

We take a look at how to protect your SSH keys by passphrase without inducing a lot of headaches. Read on to find out how.

Denny Zhang user avatar by
Denny Zhang
·
Oct. 13, 16 · DevOps Zone · Tutorial
Like (3)
Save
Tweet
3.32K Views

Join the DZone community and get the full member experience.

Join For Free

Any serious DevOps will only SSH by the key file, not with a password. Right? And mostly, our powerful key file can unlock many critical ENVs. Have you ever uploaded your private key to other ENVs, like Jumpbox? What if your key is magically stolen by hackers somehow?

Time to protect your sensitive SSH key with a passphrase, and live with it, headache-free.

Here's a cheat sheet for impatient users, though I recommend reading this post through, even for experienced users.
NameSummary
Load key filessh-add ~/.ssh/id_rsa
Remove all loaded keysssh-add -D
Whether it’s encryptedgrep “ENCRYPTED” id_rsa
Add/Change passphrasessh-keygen -p -f id_dsa
Remove passphrasessh-keygen -p -P $passwd -N “” -f id_rsa
Load key without promptCheck link: here

Add Passphrase to Existing SSH Key

We can easily use ssh-keygen to add a passphrase. This certainly gives us extra security benefit. What’s the impact of this change?

  • You never use your private key other than your computer, right? If yes, there's nothing you need to worry about. One tiny difference: you might be asked to input the passphrase once. Check all loaded keys by ssh-add -l.
  • In some cases, we might use key files to do a passwordless login with remote servers. For example, the SSH tunnel for port forwarding, the SSH from Jumpbox to other machines, etc. Then, we have to make sure that the key file is correctly loaded and recognized. Run ssh-add ./id_rsa, then input passphrase manually. This also can be done automatically, which I will explain it shortly.
# Change file mode to allow overwrite
chmod 700 id_rsa

# Add passphrase to key file
ssh-keygen -p -f id_rsa

# Denny-mac:.ssh mac$ ssh-keygen -p -f id_rsa
# Key has comment 'id_rsa'
# Enter new passphrase (empty for no passp...
# Enter same passphrase again: 
# Your identification has been saved with ...

Load Protected SSH Key Without Prompt

It's a pity that ssh-add itself doesn’t have native support for this. Here is a workaround (a bit tricky, I admit).

# Specify your passphrase here
export YOUR_PASSPHRASE="XXX"

# Load protected key without prompt
echo "echo $YOUR_PASSPHRASE" > /tmp/mypass
chmod 700 /tmp/mypass
cat id_rsa| SSH_ASKPASS=/tmp/mypass ssh-add -

# Verify loaded certificate
ssh-add -l

Change Passphrase for Existing Private Key

Run the below command. You will be asked to input the old passphrase and a new one. If the key is not encrypted, just press enter in the terminal.

ssh-keygen -p -f ~/.ssh/id_dsa

Remove Passphrase

Use openssl to remove the passphrase. You will need to manually input the old passphrase.

openssl rsa -in id_rsa -out id_rsa_new

The same can be done by ssh-keygen. The amazing part is that there is no required human intervention; it's totally automated.

ssh-keygen -p -P "$OLDPASS" -N "" -f id_rsa

More Reading: Reverse SSH Tunnel: Export Your Mac Laptop to the Internet

References

UNIX Stack Exchange

ThinkPlexx

StackOverflow 

Published at DZone with permission of Denny Zhang, DZone MVB. See the original article here.

Opinions expressed by DZone contributors are their own.

Popular on DZone

  • Building a QR Code Generator with Azure Functions
  • 5 Ways to Optimize Your CQL Queries for Performance
  • When Disaster Strikes: Production Troubleshooting
  • C++ Creator Bjarne Stroustrup Interview

Comments

DevOps Partner Resources

X

ABOUT US

  • About DZone
  • Send feedback
  • Careers
  • Sitemap

ADVERTISE

  • Advertise with DZone

CONTRIBUTE ON DZONE

  • Article Submission Guidelines
  • MVB Program
  • Become a Contributor
  • Visit the Writers' Zone

LEGAL

  • Terms of Service
  • Privacy Policy

CONTACT US

  • 600 Park Offices Drive
  • Suite 300
  • Durham, NC 27709
  • support@dzone.com
  • +1 (919) 678-0300

Let's be friends:

DZone.com is powered by 

AnswerHub logo