5 ms·
Something like https://matrixzj.github.io/documentations/idm_decrypt_ssh_private_key_with_openssl.html https://matrixzj.github.io/documentations/idm_decrypt_ssh
by jamespwilliams 3y ago
Something like https://matrixzj.github.io/documentations/idm_decrypt_ssh_private_key_with_openssl.html https://matrixzj.github.io/documentations/idm_decrypt_ssh_pr... (then ssh -i decrypted_key) should work and avoid ssh-agent
- generalizations 3y agoThanks for the link. It's ironic that in the name of security, that solution is probably one of the best available. SSH is so protected against footguns that legitimate use cases are forced to use demonstrably worse security practices, just because some people might shoot themselves in the foot. I'm stuck with either that option, expect, or a total misuse of ssh-agent.
- jamespwilliams 3y agoDepending on your use case it might be better to just store the key unencrypted. There’s not really much point encrypting it if you’re storing the passphrase on disk alongside the key anyway.
- gnufx 3y agoRight (what's the threat model)? The possibilities of restricted passphrase-less keys are under-appreciated for non-interactive use, or even interactive use. I'd rather mint an ephemeral key for an endpoint I control than type credentials or, worse, forward the agent, if I have to call out of an untrusted system (like an HPC login node).
- generalizations 3y agoI mean, the use case is I want my GUI wrapper to interactively prompt the user for the decryption password. It’s not getting saved to disk; I just want ssh capabilities (including password protected ssh keys) inside an interactive desktop app.
- gnufx 3y agoI can't tell what that involves but, for instance, the two GUI things I typically use with SSH are Emacs (openssh) and x2go (libssh), and they don't do that. Surely you want the agent anyway.
- gnufx 3y agoIf you want to remove a passphrase, just use ssh -p.