Linux – ssh-agent & ssh-add

測試環境為 CentOS 8 x86_64 虛擬機.

• SSH Server IP: 192.168.31.139
• SSH Client IP: 192.168.31.142

在使用 GitLab 的 SSH Runner 時,有看到設定 ssh-agent & ssh-add ,所以看一下這是做什麼用的,下面簡單說明 SSH Server 的登入方式,其他詳細關於 SSH 的公私鑰加密請參考 – https://benjr.tw/301

最後面我們會使用 ssh-agent & ssh-add 的方式.

輸入密碼的方式

通常我們要連 SSH Server 可以透過輸入密碼的方式(如下)

環境為 SSH Client IP:192.168.31.142 ,透過以下指令登入 SSH Server IP:192.168.31.139

[root@localhost ~]# ssh root@192.168.31.139
The authenticity of host '192.168.31.139 (192.168.31.139)' can't be established.
ECDSA key fingerprint is SHA256:M5PIEiSAGg6j2yGHGck5dNY4C22uL9XHzBHClMJh0lk.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.31.139' (ECDSA) to the list of known hosts.
root@192.168.31.139's password:
[root@localhost ~]# exit
logout
Connection to 192.168.31.139 closed.

將 Client 端的公鑰交給 SSH Server 端的方式

不想輸入密碼可以直接把 Client 端的公鑰交給 SSH Server 端即可免去輸入密碼.

Note 簡單說明公私鑰:
就是 SSH Client 端會產生一組公私鑰,公鑰要交給 SSH Server 保管, 私鑰 SSH Client 自行保管,利用這一組公私鑰來確保彼此的身份(就不需要輸入密碼).

第一步在 SSH Client IP:192.168.31.142 產生公私鑰.因為私鑰很重要通常會用一組 passphrase 來加密(存取私鑰時需要輸入該密碼)

[root@localhost ~]# ssh-keygen -t rsa -C root
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:hbp+4f5fnMp1dX5GeXJuu4BOPw9hQHcFV7TPH1AWjbg root
The key's randomart image is:
+---[RSA 3072]----+
|           . o.OX|
|         .. o =.o|
|        . .. o . |
|       . .  E ..o|
|      . S    o.oO|
|       ..   o..B*|
|      .. . o o= O|
|     .  o o..=o+o|
|      .o...o+.o+.|
+----[SHA256]-----+

接下來就是將你的公鑰交給 SSH Server 來保管.

[root@localhost ~]# scp .ssh/id_rsa.pub 192.168.31.139:/root/.ssh/
root@192.168.31.139's password:
id_rsa.pub                                                                            100%  558   536.0KB/s   00:00

[root@localhost ~]# ssh root@192.168.31.139
root@192.168.31.139's password:

Last login: Wed Jul 26 00:39:13 2023 from 192.168.31.142
[root@localhost ~]# cd ~/.ssh
[root@localhost .ssh]# cat id_rsa.pub >> authorized_keys
[root@localhost .ssh]# exit
logout
Connection to 192.168.31.139 closed.

這樣下次登入 SSH Server 就不需要輸入密碼了,但還是要輸入 存取 私鑰時的 passphrase (產生公私鑰時輸入的)

[root@localhost ~]# ssh root@192.168.31.139
Enter passphrase for key '/root/.ssh/id_rsa':

Last login: Wed Jul 26 00:39:58 2023 from 192.168.31.142
[root@localhost ~]# exit
logout
Connection to 192.168.31.139 closed.

使用 ssh-agent 免除輸入私鑰 passphrase 的密碼

不想輸入 私鑰 passphrase 的 密碼可以使用 ssh-agent

在 SSH Client IP:192.168.31.142 啟動 ssh-agent (可以寫入 ~/.bashrc 登入時啟動 ssh-agent).

[root@localhost ~]# eval `ssh-agent`
Agent pid 2408
[root@localhost ~]# echo $SSH_AGENT_PID
6264
[root@localhost ~]# echo $SSH_AUTH_SOCK
/tmp/ssh-8w8WkGfIJib3/agent.2407

接下來很簡單只需要執行 ssh-add 將 私鑰 passphrase 交給 ssh-agent 即可.

[root@localhost ~]# ssh-add
Enter passphrase for /root/.ssh/id_rsa:
Identity added: /root/.ssh/id_rsa (root)
[root@localhost ~]# ssh-add -l
3072 SHA256:hbp+4f5fnMp1dX5GeXJuu4BOPw9hQHcFV7TPH1AWjbg root (RSA)

這樣就可以免除輸入私鑰 passphrase 了.

[root@localhost ~]# ssh root@192.168.31.139

Last login: Wed Jul 26 00:40:45 2023 from 192.168.31.142
[root@localhost ~]# exit
logout