SSH: password cache if SSH-keys are forbidden

up vote
3
down vote

favorite

I have a server which I have to access frequently via ssh, because I compute on it.
Now, the computing center explicitly forbids SSH-keys because they are "insecure". They feel that typing my password, on a keyboard, everytime, possible in front of other humans, is a much safer way to login.

Now; I cannot change their minds (I tried).

Is there a way to at least temporarily store SSH passwords, the way GIT can store passwords in a cache for some defined time?

I'm on a linux machine.

asked 55 mins ago

user2667180

285

add a commentÂ |Â

up vote
3
down vote

favorite

Now; I cannot change their minds (I tried).

Is there a way to at least temporarily store SSH passwords, the way GIT can store passwords in a cache for some defined time?

I'm on a linux machine.

asked 55 mins ago

user2667180

285

add a commentÂ |Â

up vote
3
down vote

favorite

Now; I cannot change their minds (I tried).

Is there a way to at least temporarily store SSH passwords, the way GIT can store passwords in a cache for some defined time?

I'm on a linux machine.

asked 55 mins ago

user2667180

285

Now; I cannot change their minds (I tried).

Is there a way to at least temporarily store SSH passwords, the way GIT can store passwords in a cache for some defined time?

I'm on a linux machine.

linux ssh passwords ssh-keys

asked 55 mins ago

user2667180

285

asked 55 mins ago

user2667180

285

asked 55 mins ago

user2667180

285

asked 55 mins ago

user2667180

285

asked 55 mins ago

user2667180

285

add a commentÂ |Â

1 Answer
1

active

oldest

votes

up vote
3
down vote

accepted

Connection reuse

SSHv2 allows the same authenticated connection to establish multiple 'channels' Ã¢Â€Â“ interactive shell, batch command, SFTP, along with the secondary ones such as agent-forwarding or TCP-forwarding. Your server probably supports connection multiplexing by default. (If your admins complain, it's not caching your password anywhere Ã¢Â€Â“ it's caching the whole connection.)

With OpenSSH you have ControlMaster and ControlPath options (-M and -S) to make use of this:

Start a 'master' SSH connection using -M. (Since you don't have a ControlPath in your config yet, you need to specify it in command line using -S. It needs to live long, so I add the -fN options to drop to background; they're technically optional otherwise.)
```
$ ssh foo@bar.example.com -fNMS ~/.ssh/bar.socket
foo@bar.example.com's password:
```
You're back to the local shell.

Start a new connection through the master:
```
$ ssh foo@bar.example.com -S ~/.ssh/bar.socket
```
You're in.

To make this useful for Git/rsync/SFTP, you need to set up ControlPath in your configuration, because you won't be able to specify -S all the time:
```
Host *
 ControlPath ~/.ssh/S.%r@%h:%p
```

You can automate this Ã¢Â€Â“ recent OpenSSH versions also have ControlPersist which automatically establishes a master connection in background if there isn't one yet. This allows you to skip step 1 and just use ssh as you normally would.

Configuration in ~/.ssh/config:

Host *
 ControlPath ~/.ssh/S.%r@%h:%p
 ControlMaster auto
 ControlPersist 15m

First connection asks for password:

$ ssh foo@bar.example.com
foo@bar.example.com's password:
[foo@bar:~]$ exit

The second doesn't:

$ ssh foo@bar.example.com
[foo@bar:~]$ yay

To control the multiplex master (stop it or configure TCP forwardings), use the -O option.

A similar method is supported by recent PuTTY versions.

edited 12 mins ago

answered 20 mins ago

grawity

219k32446512

thank you very much for this nice answer. google was not useful on this problem, as it always turned to ssh-keys and I did not know the right keywords. helped me a lot!
â€“Â user2667180
13 mins ago

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "3"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1362894%2fssh-password-cache-if-ssh-keys-are-forbidden%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
3
down vote

accepted

Connection reuse

With OpenSSH you have ControlMaster and ControlPath options (-M and -S) to make use of this:

Start a 'master' SSH connection using -M. (Since you don't have a ControlPath in your config yet, you need to specify it in command line using -S. It needs to live long, so I add the -fN options to drop to background; they're technically optional otherwise.)
```
$ ssh foo@bar.example.com -fNMS ~/.ssh/bar.socket
foo@bar.example.com's password:
```
You're back to the local shell.

Start a new connection through the master:
```
$ ssh foo@bar.example.com -S ~/.ssh/bar.socket
```
You're in.

To make this useful for Git/rsync/SFTP, you need to set up ControlPath in your configuration, because you won't be able to specify -S all the time:
```
Host *
 ControlPath ~/.ssh/S.%r@%h:%p
```

Configuration in ~/.ssh/config:

Host *
 ControlPath ~/.ssh/S.%r@%h:%p
 ControlMaster auto
 ControlPersist 15m

First connection asks for password:

$ ssh foo@bar.example.com
foo@bar.example.com's password:
[foo@bar:~]$ exit

The second doesn't:

$ ssh foo@bar.example.com
[foo@bar:~]$ yay

To control the multiplex master (stop it or configure TCP forwardings), use the -O option.

A similar method is supported by recent PuTTY versions.

edited 12 mins ago

answered 20 mins ago

grawity

219k32446512

thank you very much for this nice answer. google was not useful on this problem, as it always turned to ssh-keys and I did not know the right keywords. helped me a lot!
â€“Â user2667180
13 mins ago

add a commentÂ |Â

up vote
3
down vote

accepted

Connection reuse

With OpenSSH you have ControlMaster and ControlPath options (-M and -S) to make use of this:

Start a 'master' SSH connection using -M. (Since you don't have a ControlPath in your config yet, you need to specify it in command line using -S. It needs to live long, so I add the -fN options to drop to background; they're technically optional otherwise.)
```
$ ssh foo@bar.example.com -fNMS ~/.ssh/bar.socket
foo@bar.example.com's password:
```
You're back to the local shell.

Start a new connection through the master:
```
$ ssh foo@bar.example.com -S ~/.ssh/bar.socket
```
You're in.

To make this useful for Git/rsync/SFTP, you need to set up ControlPath in your configuration, because you won't be able to specify -S all the time:
```
Host *
 ControlPath ~/.ssh/S.%r@%h:%p
```

Configuration in ~/.ssh/config:

Host *
 ControlPath ~/.ssh/S.%r@%h:%p
 ControlMaster auto
 ControlPersist 15m

First connection asks for password:

$ ssh foo@bar.example.com
foo@bar.example.com's password:
[foo@bar:~]$ exit

The second doesn't:

$ ssh foo@bar.example.com
[foo@bar:~]$ yay

To control the multiplex master (stop it or configure TCP forwardings), use the -O option.

A similar method is supported by recent PuTTY versions.

edited 12 mins ago

answered 20 mins ago

grawity

219k32446512

thank you very much for this nice answer. google was not useful on this problem, as it always turned to ssh-keys and I did not know the right keywords. helped me a lot!
â€“Â user2667180
13 mins ago

add a commentÂ |Â

up vote
3
down vote

accepted

Connection reuse

With OpenSSH you have ControlMaster and ControlPath options (-M and -S) to make use of this:

Start a 'master' SSH connection using -M. (Since you don't have a ControlPath in your config yet, you need to specify it in command line using -S. It needs to live long, so I add the -fN options to drop to background; they're technically optional otherwise.)
```
$ ssh foo@bar.example.com -fNMS ~/.ssh/bar.socket
foo@bar.example.com's password:
```
You're back to the local shell.

Start a new connection through the master:
```
$ ssh foo@bar.example.com -S ~/.ssh/bar.socket
```
You're in.

To make this useful for Git/rsync/SFTP, you need to set up ControlPath in your configuration, because you won't be able to specify -S all the time:
```
Host *
 ControlPath ~/.ssh/S.%r@%h:%p
```

Configuration in ~/.ssh/config:

Host *
 ControlPath ~/.ssh/S.%r@%h:%p
 ControlMaster auto
 ControlPersist 15m

First connection asks for password:

$ ssh foo@bar.example.com
foo@bar.example.com's password:
[foo@bar:~]$ exit

The second doesn't:

$ ssh foo@bar.example.com
[foo@bar:~]$ yay

To control the multiplex master (stop it or configure TCP forwardings), use the -O option.

A similar method is supported by recent PuTTY versions.

edited 12 mins ago

answered 20 mins ago

grawity

219k32446512

Connection reuse

With OpenSSH you have ControlMaster and ControlPath options (-M and -S) to make use of this:

Start a 'master' SSH connection using -M. (Since you don't have a ControlPath in your config yet, you need to specify it in command line using -S. It needs to live long, so I add the -fN options to drop to background; they're technically optional otherwise.)
```
$ ssh foo@bar.example.com -fNMS ~/.ssh/bar.socket
foo@bar.example.com's password:
```
You're back to the local shell.

Start a new connection through the master:
```
$ ssh foo@bar.example.com -S ~/.ssh/bar.socket
```
You're in.

To make this useful for Git/rsync/SFTP, you need to set up ControlPath in your configuration, because you won't be able to specify -S all the time:
```
Host *
 ControlPath ~/.ssh/S.%r@%h:%p
```

Configuration in ~/.ssh/config:

Host *
 ControlPath ~/.ssh/S.%r@%h:%p
 ControlMaster auto
 ControlPersist 15m

First connection asks for password:

$ ssh foo@bar.example.com
foo@bar.example.com's password:
[foo@bar:~]$ exit

The second doesn't:

$ ssh foo@bar.example.com
[foo@bar:~]$ yay

To control the multiplex master (stop it or configure TCP forwardings), use the -O option.

A similar method is supported by recent PuTTY versions.

edited 12 mins ago

answered 20 mins ago

grawity

219k32446512

edited 12 mins ago

answered 20 mins ago

grawity

219k32446512

answered 20 mins ago

grawity

219k32446512

answered 20 mins ago

grawity

219k32446512

thank you very much for this nice answer. google was not useful on this problem, as it always turned to ssh-keys and I did not know the right keywords. helped me a lot!
â€“Â user2667180
13 mins ago

add a commentÂ |Â

thank you very much for this nice answer. google was not useful on this problem, as it always turned to ssh-keys and I did not know the right keywords. helped me a lot!
â€“Â user2667180
13 mins ago

thank you very much for this nice answer. google was not useful on this problem, as it always turned to ssh-keys and I did not know the right keywords. helped me a lot!
â€“Â user2667180
13 mins ago

add a commentÂ |Â

draft saved

draft discarded

draft saved

draft discarded

Post as a guest

Name

Search This Blog

Iyfjky