May 05, 2020 SSH stands for Secure Shell and is a method used to establish a secure connection between two computers. SSH works by authenticating based on a key pair, with a private key being on a remote server and the corresponding public key on a local machine. When the keys match, access is granted to the remote user. Using keychain with SSH If you use ssh's built in public-key/private-key passwordless authentication with an encrypted private key, you may find it annoying to enter the private key password in all the time. Ssh-agent provides some releaf for the problem, but not to as far an extent as we would hope. So, the nice folks at IBM created keychain. Dec 03, 2019 Start by adding your key to the Keychain Access by passing -K option to the ssh-add command: ssh-add -K /.ssh/idrsawhatever. Now you can see your SSH key in Keychain Access: But if you remove the keys from ssh-agent with ssh-add -D or restart your computer, you will be prompted for password again when you try to use SSH. Turns out there's. Apr 23, 2003 Keychain either starts ssh-agent or attaches to an existing instance and is then used on a permanent basis—at least, until the next reboot. This can be a great timesaver when you’re logging in. Keychain is a section in Termius, where you can import and generate ssh keys, and create identities. It is also where you can see, edit and remove all your imported or generated keys and identities. For key-based authentication, link a key with a host in the host properties. In the desktop app, the keychain can be found in Preferences Keychain.
Keychain helps you to manage SSH and GPG keys in a convenient and secure manner. It acts as a frontend to ssh-agent and ssh-add, but allows you to easily have one long running ssh-agent process per system, rather than the norm of one ssh-agent per login session.
This dramatically reduces the number of times you need to enter your passphrase. With keychain, you only need to enter a passphrase once every time your local machine is rebooted. Keychain also makes it easy for remote cron jobs to securely 'hook in' to a long-running ssh-agent process, allowing your scripts to take advantage of key-based logins.
Those who are new to OpenSSH and the use of public/private keys for authentication may want to check out the following articles by Daniel Robbins, which will provide a gentle introduction to the concepts used by Keychain:
Download and Resources
The latest release of keychain is version 2.8.5, and was released on January 24, 2018. The current version of keychain supports gpg-agent as well as ssh-agent (including GPG2.)
Keychain is compatible with many operating systems, including AIX, *BSD, Cygwin, MacOS X, Linux, WSL, HP/UX, Tru64 UNIX, IRIX, Solaris and GNU Hurd.
Download
The latest release of Keychain can be found on the keychain GitHub release page.
Keychain development sources can be found on GitHub. Please feel free to use the GitHub issue tracker to report bugs. Alternatively, the Funtoo Linux bug tracker can be used. For support, you can visit us in the #funtoo irc channel or the Funtoo forums for keychain support questions.
Project History
Daniel Robbins originally wrote keychain 1.0 through 2.0.3. 1.0 was written around June 2001, and 2.0.3 was released in late August, 2002.
After 2.0.3, keychain was maintained by various Gentoo developers, including Seth Chandler, Mike Frysinger and Robin H. Johnson, through July 3, 2003.
On April 21, 2004, Aron Griffis committed a major rewrite of keychain which was released as 2.2.0. Aron continued to actively maintain and improve keychain through October 2006 and the keychain 2.6.8 release. He also made a few commits after that date, up through mid-July, 2007. At this point, keychain had reached a point of maturity.
In mid-July, 2009, Daniel Robbins migrated Aron's mercurial repository to git and set up a new project page on funtoo.org, and made a few bug fix commits to the git repo that had been collecting in bugs.gentoo.org. Daniel maintained keychain through September of 2017.
As of September 2017, keychain is now being maintained by Funtoo Linux developer Ryan Harris (x48rph).
Quick Setup
Linux
To install under Gentoo or Funtoo Linux, type
For other Linux distributions, use your distribution's package manager, or download and install using the source tarball above. Then generate RSA keys if necessary. The quick install docs assume you have a RSA key pair named id_rsa and id_rsa.pub in your ~/.ssh/ directory. Add the following to your ~/.bash_profile:
If you want to take advantage of GPG functionality, ensure that GNU Privacy Guard is installed and omit the --agents ssh option above.
Apple MacOS X
Assuming you have an id_rsa and id_rsa.pub key pair in your ~/.ssh/ directory, add the following to your ~/.bash_profile:
The --inherit any option above causes keychain to inherit any ssh key passphrases stored in your Apple MacOS Keychain. If you would prefer for this to not happen, then this option can be omitted.
Fish Shell
Currently, keychain is not compatible with Fish shell.
Background
You're probably familiar with ssh, which has become a secure replacement for the venerable telnet and rsh commands.
Typically, when one uses ssh to connect to a remote system, one supplies a secret passphrase to ssh, which is then passed in encrypted form over the network to the remote server. This passphrase is used by the remote sshd server to determine if you should be granted access to the system.
However, OpenSSH and nearly all other SSH clients and servers have the ability to perform another type of authentication, called asymmetric public key authentication, using the RSA or other authentication algorithms. They are very useful, but can also be complicated to use. keychain has been designed to make it easy to take advantage of the benefits of public key authentication.
Generating a Key Pair
To use public key authentication, first you use a program called ssh-keygen (included with OpenSSH) to generate a key pair -- two small files. One of the files is the public key. The other small file contains the private key. ssh-keygen will ask you for a passphrase, and this passphrase will be used to encrypt your private key. You will need to supply this passphrase to use your private key. If you wanted to generate a RSA key pair, you would do this:
You would then be prompted for a location to store your key pair. If you do not have one currently stored in ~/.ssh, it is fine to accept the default location:
Then, you are prompted for a passphrase. This passphrase is used to encrypt the private key on disk, so even if it is stolen, it will be difficult for someone else to use it to successfully authenticate as you with any accounts that have been configured to recognize your public key.
Note that conversely, if you do not provide a passphrase for your private key file, then your private key file will not be encrypted. This means that if someone steals your private key file, they will have the full ability to authenticate with any remote accounts that are set up with your public key.
Below, I have supplied a passphrase so that my private key file will be encrypted on disk:
Setting up Authentication
Here's how you use these files to authenticate with a remote server. On the remote server, you would append the contents of your public key to the ~.ssh/authorized_keys file, if such a file exists. If it doesn't exist, you can simply create a new authorized_keys file in the remote account's ~/.ssh directory that contains the contents of your local id_rsa.pub file.
Then, if you weren't going to use keychain, you'd perform the following steps. On your local client, you would start a program called ssh-agent, which runs in the background. Then you would use a program called ssh-add to tell ssh-agent about your secret private key. Then, if you've set up your environment properly, the next time you run ssh, it will find ssh-agent running, grab the private key that you added to ssh-agent using ssh-add, and use this key to authenticate with the remote server.
Again, the steps in the previous paragraph is what you'd do if keychain wasn't around to help. If you are using keychain, and I hope you are, you would simply add the following line to your ~/.bash_profile or if a regular user to~/.bashrc :
The next time you log in or source your ~/.bash_profile or if you use ~/.bashrc, keychain will start, start ssh-agent for you if it has not yet been started, use ssh-add to add your id_rsa private key file to ssh-agent, and set up your shell environment so that ssh will be able to find ssh-agent. If ssh-agent is already running, keychain will ensure that your id_rsa private key has been added to ssh-agent and then set up your environment so that ssh can find the already-running ssh-agent. It will look something like this:
Note that when keychain runs for the first time after your local system has booted, you will be prompted for a passphrase for your private key file if it is encrypted. But here's the nice thing about using keychain -- even if you are using an encrypted private key file, you will only need to enter your passphrase when your system first boots (or in the case of a server, when you first log in.) After that, ssh-agent is already running and has your decrypted private key cached in memory. So if you open a new shell, you will see something like this:
This means that you can now ssh to your heart's content, without supplying a passphrase.
You can also execute batch cron jobs and scripts that need to use ssh or scp, and they can take advantage of passwordless public key authentication as well. To do this, you would add the following line to the top of a bash script:
The extra --noask option tells keychain that it should not prompt for a passphrase if one is needed. Since it is not running interactively, it is better for the script to fail if the decrypted private key isn't cached in memory via ssh-agent.
Keychain Options
Specifying Agents
Keychain Ssh Code
In the images above, you will note that keychain starts ssh-agent, but also starts gpg-agent. Modern versions of keychain also support caching decrypted GPG keys via use of gpg-agent, and will start gpg-agent by default if it is available on your system. To avoid this behavior and only start ssh-agent, modify your ~/.bash_profile as follows:
The additional --agents ssh option tells keychain just to manage ssh-agent, and ignore gpg-agent even if it is available.
Clearing Keys
Sometimes, it might be necessary to flush all cached keys in memory. To do this, type:
Any agent(s) will continue to run.
Improving Security
To improve the security of keychain, some people add the --clear option to their ~/.bash_profilekeychain invocation. The rationale behind this is that any user logging in should be assumed to be an intruder until proven otherwise. This means that you will need to re-enter any passphrases when you log in, but cron jobs will still be able to run when you log out.
Stopping Agents
If you want to stop all agents, which will also of course cause your keys/identities to be flushed from memory, you can do this as follows:
If you have other agents running under your user account, you can also tell keychain to just stop only the agents that keychain started:
GPG
Keychain can ask you for your GPG passphrase if you provide it the GPG key ID. To find it out:
Note the DEADBEEF above is the ID. Then, in your login script, do your usual
GPG Key Format
Running on for example Ubuntu 18.04 LTS (the most common WSL distribution) with keychain version 2.8.2 and GPG version 2.2.4 produces a problem where GPG can not find keys with error message
This can be fixed by configuring GPG to use the long key ID format
Ssh Keychain Mac Os X
GPG Cache Time
By default the GPG agent sets the default cache time to 600 seconds and the maximum cache time to 7200 seconds. You may wish to consider changing these options if you tend to use a long running session and wish to keep your gpg key cached. To do so set the options in ~/.gnupg/gpg-agent.conf.
GnuPG version up to 2
GnuPG version 2.1 and above
Learning More
The instructions above will work on any system that uses bash as its default shell, such as most Linux systems and Mac OS X.
To learn more about the many things that keychain can do, including alternate shell support, consult the keychain man page, or type keychain --help | less for a full list of command options.
I also recommend you read my original series of articles about OpenSSH that I wrote for IBM developerWorks, called OpenSSH Key Management. Please note that keychain 1.0 was released along with Part 2 of this article, which was written in 2001. keychain has changed quite a bit since then. In other words, read these articles for the conceptual and OpenSSH information, but consult the keychain man page for command-line options and usage instructions :)
- Common Threads: OpenSSH key management, Part 1 - Understanding RSA/DSA Authentication
- Common Threads: OpenSSH key management, Part 2 - Introducing ssh-agent and keychain
- Common Threads: OpenSSH key management, Part 3 - Agent forwarding and keychain improvements
As mentioned at the top of the page, keychain development sources can be found in the keychain git repository. Please use the Funtoo Forums and #funtoo irc channel for keychain support questions as well as bug reports.
Browse all our available articles below. Use the search field to search for topics and keywords in real-time.
| Article | Subtitle |
|---|---|
| Article | Subtitle |
| Awk by Example, Part 1 | An intro to the great language with the strange name |
| Awk by Example, Part 2 | Records, loops, and arrays |
| Awk by Example, Part 3 | String functions and ... checkbooks? |
| Bash by Example, Part 1 | Fundamental programming in the Bourne again shell (bash) |
| Bash by Example, Part 2 | More bash programming fundamentals |
| Bash by Example, Part 3 | Exploring the ebuild system |
| BTRFS Fun | |
| Funtoo Filesystem Guide, Part 1 | Journaling and ReiserFS |
| Funtoo Filesystem Guide, Part 2 | Using ReiserFS and Linux |
| Funtoo Filesystem Guide, Part 3 | Tmpfs and Bind Mounts |
| Funtoo Filesystem Guide, Part 4 | Introducing Ext3 |
| Funtoo Filesystem Guide, Part 5 | Ext3 in Action |
| GUID Booting Guide | |
| Learning Linux LVM, Part 1 | Storage management magic with Logical Volume Management |
| Learning Linux LVM, Part 2 | The cvs.gentoo.org upgrade |
| Libvirt | |
| Linux Fundamentals, Part 1 | |
| Linux Fundamentals, Part 2 | |
| Linux Fundamentals, Part 3 | |
| Linux Fundamentals, Part 4 | |
| Making the Distribution, Part 1 | |
| Making the Distribution, Part 2 | |
| Making the Distribution, Part 3 | |
| Maximum Swappage | Getting the most out of swap |
| On screen annotation | Write on top of apps on your screen |
| OpenSSH Key Management, Part 1 | Understanding RSA/DSA Authentication |
| OpenSSH Key Management, Part 2 | Introducing ssh-agent and keychain |
| OpenSSH Key Management, Part 3 | Agent Forwarding |
| Partition Planning Tips | Keeping things organized on disk |
| Partitioning in Action, Part 1 | Moving /home |
| Partitioning in Action, Part 2 | Consolidating data |
| POSIX Threads Explained, Part 1 | A simple and nimble tool for memory sharing |
| POSIX Threads Explained, Part 2 | |
| POSIX Threads Explained, Part 3 | Improve efficiency with condition variables |
| Sed by Example, Part 1 | |
| Sed by Example, Part 2 | |
| Sed by Example, Part 3 | |
| Successful booting with UUID | Guide to use UUID for consistent booting. |
| The Gentoo.org Redesign, Part 1 | A site reborn |
| The Gentoo.org Redesign, Part 2 | The Documentation System |
| The Gentoo.org Redesign, Part 3 | The New Main Pages |
| The Gentoo.org Redesign, Part 4 | The Final Touch of XML |
| Traffic Control | |
| Windows 10 Virtualization with KVM |