从bash脚本ssh-add和自动化密码短语

Question

我正在尝试从脚本ssh-add（不关心当前的安全性）。

现在ssh提示输入密码，这需要自动执行，所以我读了几个例如this和发现expect。

，现在我做如下：

eval `ssh-agent -s` 

脚本tmp.sh定义为：

#!/usr/bin/expect 
spawn ssh-add /root/.ssh/id_rsa 
expect "Enter passphrase for /root/.ssh/id_rsa:" 
send "my_pass" 
interact 

./tmp.sh

ssh-add -l

如果SSH-ADD会工作这表明像

4096 SHA256:wlfP/nhVSWXLcljBOen5GSYZXJGgfi/XJWfZeBwqRsM id_rsa (RSA)

而是我得到The agent has no identities.好像SSH代理失去它的上下文。

对此可以采用其他解决方案。

Answer 1

更新，因为第一个没有工作

我没有尝试这一点，但如果是真的约指望松动的背景下，这可能是一个好主意，后来将其设置：

自动口令-add.expect（取代tmp.sh）

/usr/bin/expect 
spawn ./ssh-agent-ssh-add.sh /root/.ssh/id_rsa 
expect "Enter passphrase for /root/.ssh/id_rsa:" 
send "my_pass" 
interact 

ssh-agent-ssh-add.sh

#!/bin/sh 
eval `ssh-agent -s` 
ssh-add "[email protected]" 

Answer 2

我个人觉得使用起来有点麻烦。以下方法发现how to make ssh-add read passphrase from a file更具信息性。

所以，如果你的ssh-add版本允许-p参数，你不担心安全问题那么这应该工作：

#!/bin/bash 
# store a file somewheres with your passphrase. For example's sake 
# I'll just use $HOME/.myscrt 

<$HOME/.myscrt ssh-add -p ~/.ssh/id_rsa 

现在，如果-p是不是一个选择，我找到了第二个方法婉转巧妙：

#!/bin/bash 
# Same passfile and some minor enhancements from the OP of the linked 
# solution 
PASS="$(<$HOME/.myscrt)" 

# the following is just a one-liner method of making an executable 
# one-line script echoing the password to STDOUT 
install -vm700 <(echo "echo $PASS") "$PWD/ps.sh" 

# then the magic happens. NOTE: your DISPLAY variable should be set 
# for this method to work (see ssh-add(1)) 
[[ -z "$DISPLAY" ]] && export DISPLAY=:0 
< id_rsa SSH_ASKPASS="$PWD/ps.sh" ssh-add - && shred -n3 -uz $PWD/ps.sh  

当我测试了我所谓的 “J” 的脚本，见下图：

$ cd /tmp 
$ ssh-keygen 
Generating public/private rsa key pair. 
Enter file in which to save the key (/home/me/.ssh/id_rsa): /tmp/id_rsa 
Enter passphrase (empty for no passphrase): asdfasdf 
Enter same passphrase again: asdfasdf 
Your identification has been saved in /tmp/id_rsa. 
Your public key has been saved in /tmp/id_rsa.pub. 
The key fingerprint is: 
ed:1a:ae:c7:ac:47:5e:31:98:8e:18:8f:1c:67:94:6d [email protected] 
The key's randomart image is: 
+--[ RSA 2048]----+ 
|  o   | 
|  o E  | 
|  . . o  | 
| o o o.o  | 
| . O oS .o  | 
| + o o..  | 
|  =...  | 
|  .*o  | 
|  o=o  | 
+-----------------+ 
$ echo 'asdfasdf' > ~/.myscrt 
$ chmod 0600 ~/.myscrt 
$ ls -altr ~/.myscrt 
-rw------- 1 me me 9 Feb 16 19:00 /home/me/.myscrt 
$ cat ~/.myscrt 
asdfasdf 
$ ls -ltr 
total 12 
-rw-r--r-- 1 me me 400 Feb 16 18:59 id_rsa.pub 
-rw------- 1 me me 1766 Feb 16 18:59 id_rsa 
-rwx------ 1 me me 151 Feb 16 19:04 j 
$ cat j 
#!/bin/bash 
PASS="$(<$HOME/.myscrt)" 
install -vm700 <(echo "echo $PASS") "$PWD/ps.sh" 
cat id_rsa | SSH_ASKPASS="$PWD/ps.sh" ssh-add - && shred -n3 -uz  $PWD/ps.sh 
$ ./j 
‘/dev/fd/63’ -> ‘/tmp/so/ps.sh’ 
Identity added: (stdin) ((stdin)) 
$ ls 
id_rsa id_rsa.pub j 

所以，有一点需要注意的快速关于这个方法是列出装入ssh-agent身份只会显示stdin加载：

$ ssh-add -D 
All identities removed. 
$ ssh-add -l 
2048 ed:1a:ae:c7:ac:47:5e:31:98:8e:18:8f:1c:67:94:6d (stdin) (RSA) 
$ ./j 
‘/dev/fd/63’ -> ‘/tmp/so/ps.sh’ 
Identity added: (stdin) ((stdin)) 
$ ssh-add -l 
2048 ed:1a:ae:c7:ac:47:5e:31:98:8e:18:8f:1c:67:94:6d (stdin) (RSA)