110
why can't I connect to my ssh server UNLESS I enter eval "$(ssh-agent -s)" first?
(lemmy.dbzer0.com)
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
The whole point of ssh-agent is to remember your passphrase. If you don't want to do that your problem might be that for some reason ssh client doesn't pick up your key. Try defining it for the host
Also, there's -v flag for ssh. Use it to debug what's going on when it doesn't try to use your key
okay I tried that, using -i to specify private key. I get the same thing: blank / blinking cursor. When I use verbose -v flag, I see that in both (using -i, the config file, and originally) cases (I see about 50 lines) it ends with these two lines:
where (etc) is some redacted text. It seems the server is ACCEPTING the key, which is nice. But then it's still a blinking cursor...
Check if it is true. In the server logs.
I'm not sure which logs I can and should check, but when I listen to this:
sudo tail -f /var/log/auth.log
I only get this right after I ctrl+C on my blank / blinking cursor screen. (Did this 3 times in a row.)
Where MY_PUBLIC_IP is redacted. I'm not even sure why my public IP is showing. I connect locally. But ports are forwarded, yes.
Using
sudo journalctl -u sshd -f
does not seem to output anything...That's only part of the handshake. It'd require agent input around that point.
replace passphrase with private key and you're very correct.
passphrases used to login to servers using PasswordAuthentication are not stored in the agent. i might be wrong with technical details on how the private key is actually stored in RAM by the agent, but in the context of ssh passphrases that could be directly used for login to servers, saying the agent stores passphrases is at least a bit misleading.
what you want is:
also an idea:
all depends on the level of security you want to achieve. additional TOTP could improve security too (but beware that some authenticator providers might have "sharing" features which could compromise the TOTP token even before its first use.
FWIW, I've found that the -v flag often doesn't say why it's not using your key, just that it isn't using your key and it has fallen back to password authentication.
It's usually not terribly helpful for figuring out why it's not using your key, just that it's not using your key, which you kind of already know if it's prompting you for a password. lol
Because it's basically axiomatic: ssh uses all keys it knows about. The system can't tell you why it's not using something it doesn't know it should be able to use. You can give a -i for the certificate to check if it doesn't know it because the content is broken or the location.
That said: this doesn't make -v more useful for cases like this, just because there's a reason!
Not OP but everytime I used the verbose output of ssh it didn't help me one bit. Even adding outrageous verbosity I was still quite confused on what step failed and which didn't.
I'm probably just bad at understanding SSH but i don't know it seems like ssh workflow includes many trial and error until it finds a way to connect.
Imo the verbose output of SSH is often not very helpful if you don't know very well ssh in the first place. Obviously it is still worth a shot and a good advice but don't expect ssh to clearly state what is going on :)
Well, you have configuration and flag options to define what is it supposed to be trying to use. What order, I think too. But definitely understanding SSH a little bit will make the log more understandable. As with everything tbh :D
This likely isn't helpful but it isn't meant to be a shitpost. However, I will point out this literature:
SSH, The Secure Shell: The Definitive Guide, 2nd Edition
https://github.com/manish-old/ebooks-2/blob/master/O'Reilly%20-%20SSH%20The%20Secure%20Shell%20The%20Definitive%20Guide-2.pdf
Other commenters clearly know more than me about tbs ssh, so I'll otherwise remain silent.