5 ms·

Not sure why you're getting downvotes. I use key authentication for all my SSH needs. If it's important enough to still need a password on top of that, the pa

by imron 12y ago

Not sure why you're getting downvotes. I use key authentication for all my SSH needs. If it's important enough to still need a password on top of that, the password can go on the key.

deleted 12y ago
[deleted]
e12e 12y ago
Huh? Always encrypt the ssh-key, and use ssh-agent for convenience. That said it is now quite easy to set up proper two-factor authentication: eg key and otp.
- lobster_johnson 12y ago
  On OS X, the keychain app caches the private key password forever. Even after a reboot. Any idea how to fix this? Ideally Keychain should ask me again (say) an hour after my last login with the same key.
  - cflee 12y ago
    I don't think you can set this at a key-specific level, but in Keychain Access, you can ctrl-click on the keychain and set it to lock after x min of inactivity / when sleeping. I'm not sure if you can put your ssh keys on a specific (non-login) keychain. If you want those, you may want to go to Keychain Access > Preferences > First Aid > uncheck "Keep login keychain unlocked".
    - rectang 12y ago
      You can drag-and-drop items between keychains -- you just need to enter the passwords for both keychains when doing so. This makes it possible to keep valuable items in one or more auxiliary keychains set to always prompt (lock after 0 minutes). (This technique isn't a panacea but it contributes to defense in depth.)
    - lobster_johnson 12y ago
      Brilliant, I didn't know you could lock them. However, it doesn't solve the agent caching problem. Once a key has been added the agent, Keychain never asks again, even after it's locked. ssh-add has an option "-t <seconds>" to make added keys automatically expire. That will work, but it only works for newly added keys. As far as I can tell, the Keychain helper calls ssh-add to add keys, and I don't see a way to have it pass -t. Edit: Looks like holmar's suggestion below to change the ssh-agent daemon to run with -t would fix this.
  - holmars 12y ago
    I'm using this here: http://apple.stackexchange.com/questions/118223/make-my-password-protected-ssh-key-expire-or-timeout-after-a-while/118624#118624 http://apple.stackexchange.com/questions/118223/make-my-pass...

by imron 12y ago

Not sure why you're getting downvotes. I use key authentication for all my SSH needs. If it's important enough to still need a password on top of that, the password can go on the key.

deleted 12y ago

[deleted]

e12e 12y ago

Huh? Always encrypt the ssh-key, and use ssh-agent for convenience. That said it is now quite easy to set up proper two-factor authentication: eg key and otp.

lobster_johnson 12y ago
On OS X, the keychain app caches the private key password forever. Even after a reboot. Any idea how to fix this? Ideally Keychain should ask me again (say) an hour after my last login with the same key.
- cflee 12y ago
  I don't think you can set this at a key-specific level, but in Keychain Access, you can ctrl-click on the keychain and set it to lock after x min of inactivity / when sleeping. I'm not sure if you can put your ssh keys on a specific (non-login) keychain. If you want those, you may want to go to Keychain Access > Preferences > First Aid > uncheck "Keep login keychain unlocked".
  - rectang 12y ago
    You can drag-and-drop items between keychains -- you just need to enter the passwords for both keychains when doing so. This makes it possible to keep valuable items in one or more auxiliary keychains set to always prompt (lock after 0 minutes). (This technique isn't a panacea but it contributes to defense in depth.)
  - lobster_johnson 12y ago
    Brilliant, I didn't know you could lock them. However, it doesn't solve the agent caching problem. Once a key has been added the agent, Keychain never asks again, even after it's locked. ssh-add has an option "-t <seconds>" to make added keys automatically expire. That will work, but it only works for newly added keys. As far as I can tell, the Keychain helper calls ssh-add to add keys, and I don't see a way to have it pass -t. Edit: Looks like holmar's suggestion below to change the ssh-agent daemon to run with -t would fix this.
- holmars 12y ago
  I'm using this here: http://apple.stackexchange.com/questions/118223/make-my-password-protected-ssh-key-expire-or-timeout-after-a-while/118624#118624 http://apple.stackexchange.com/questions/118223/make-my-pass...