ssh-agent for multiple terminals

Skaperen · 04-15-2011, 08:43 AM

I use many terminal windows and/or virtual consoles on Linux, often as many as 60 of them. I'm now trying to start using ssh-agent to keep my SSH keys encrypted. What I am finding is that using ssh-agent on each creates multiple instances. That doesn't work very well. It seems what I need to do is create one instance and get all the information shared into the environment space of each terminal/console instance. Before I go off to design something to do that, I'm just wondering if it has been done, already.

Skaperen · 04-15-2011, 09:17 AM

My first thought is to start the ssh-agent from a script which captures the named socket path and makes a fixed symlink pointing to it. Of course, this defeats obscurity of the path, but is that real security (answer: no). Another symlink is made to store the PID. Then I would have a bash alias or command function in the login shell for each terminal that can refresh the environment variables from those known symlinks. I would run that in each login shell. Alternatively, an ssh wrapper script would pick up those values to pass directly to the real ssh program. What security risks might this be creating?

nomb · 04-15-2011, 10:43 AM

I'm pretty sure you can have ssh-agent write it's socket path out to a file and then just source it.

nomb · 04-15-2011, 10:47 AM

http://superuser.com/questions/14104...login-sessions

Skaperen · 04-15-2011, 12:38 PM

The first security issue I found was one of my own making. I had "ForwardAgent yes" in my .ssh/config files. That's fixed, now. That would not work well when accessing servers where other admins have root access. It will have to be specific to fully trusted machines.

Skaperen · 04-15-2011, 12:46 PM

Quote:

Originally Posted by nomb

http://superuser.com/questions/14104...login-sessions

Here's what I started dabbling with on my own called "start-ssh-agent":

Code:

#!/bin/bash

cd || exit 1

if [[ -n "${kill}" || -n "${KILL}" ]] ; then
	if [[ -L .ssh_agent_pid ]] ; then
		ssh_agent_pid=$( exec readlink .ssh_agent_pid )
		kill -TERM "${ssh_agent_pid}" 2>/dev/null
		sleep 1
		kill -KILL "${ssh_agent_pid}" 2>/dev/null
	fi
else
	if [[ -L .ssh_agent_pid ]] ; then
		ssh_agent_pid=$( exec readlink .ssh_agent_pid )
		echo "SSH agent already active at process ID ${ssh_agent_pid}"
		echo "kill it or run:  kill=yes start-ssh-agent" "$@"
		exit 1
	fi
fi

if [[ -L .ssh_auth_sock ]] ; then
	ssh_auth_sock=$( exec readlink .ssh_auth_sock )
	rm -fv "${ssh_auth_sock}"
	rm -f .ssh_auth_sock
fi

eval $( exec ssh-agent -s ) 1>/dev/null

ln -fns "${SSH_AUTH_SOCK}" .ssh_auth_sock
ln -fns "${SSH_AGENT_PID}" .ssh_agent_pid

ls -dGl .ssh_auth_sock
ls -dGl .ssh_agent_pid

exit 0

Now I need to either set up a bash alias/function to set these variables in its environment, or make an ssh wrapper that picks them up and sets them in that context. Since I already have an ssh wrapper for other reasons, I'll favor that for my first attempt.