在 Windows 上使用 Git Bash 时，如何防止每次都必须输入解密私钥的密码？

How to prevent that the password to decrypt the private key has to be entered every time when using Git Bash on Windows?

提问by D.Giunchi

I've an automatic building service which download from a git private repository. The problem is that when it tries to clone repository it need to provide the password, because it is not remembered; so because there is no human interaction, it waits forever the password. How can I force it to remember from id_rsa.pub?

我有一个从 git 私有存储库下载的自动构建服务。问题是当它试图克隆存储库时需要提供密码，因为它没有被记住；所以因为没有人为交互，它永远等待密码。如何强制它记住 id_rsa.pub？

回答by starmonkey

For Windows users, just a note that this is how I set up the Git Bash environment to log me in oncewhen I start it up. I edit my ~/.bashrcfile:

对于 Windows 用户，请注意，这是我设置 Git Bash 环境以在我启动时登录一次的方式。我编辑我的~/.bashrc文件：

eval `ssh-agent`
ssh-add

So when I start Git Bash, it looks like:

所以当我启动 Git Bash 时，它看起来像：

Welcome to Git (version 1.7.8-preview20111206)
(etc)
Agent pid 3376
Enter passphrase for /c/Users/starmonkey/.ssh/id_dsa:
Identity added: /c/Users/starmonkey/.ssh/id_dsa (/c/Users/starmonkey/.ssh/id_dsa)

And now I can ssh to other servers without logging in every time.

现在我可以 ssh 到其他服务器而无需每次都登录。

回答by Stephen Tun Aung

This answer explains how to get the GitHub username and password to be stored permanently, not the SSH key passphrase.

这个答案解释了如何永久存储 GitHub 用户名和密码，而不是 SSH 密钥密码。

In Windows, just run

在 Windows 中，只需运行

$ git config --global credential.helper wincred

This means that the next time you push, you'll enter your username and password as usual, but they'll be saved in Windows credentials. You won't have to enter them again, after that.

这意味着下次推送时，您将像往常一样输入用户名和密码，但它们将保存在 Windows 凭据中。之后，您将不必再次输入它们。

As in, Push to GitHub without entering username and password every time (Git Bash on Windows).

如，每次推送到 GitHub 时无需输入用户名和密码（Windows 上的 Git Bash）。

回答by Conan

I prefer not to have to type my SSH passphrase when opening new terminals; unfortunately starmonkey's solutionrequires the password to be typed in for every session. Instead, I have this in my .bash_profilefile:

我不想在打开新终端时输入我的 SSH 密码；不幸的是，starmonkey 的解决方案需要为每个会话输入密码。相反，我的.bash_profile文件中有这个：

# Note: ~/.ssh/environment should not be used, as it
#       already has a different purpose in SSH.

env=~/.ssh/agent.env

# Note: Don't bother checking SSH_AGENT_PID. It's not used
#       by SSH itself, and it might even be incorrect
#       (for example, when using agent-forwarding over SSH).

agent_is_running() {
    if [ "$SSH_AUTH_SOCK" ]; then
        # ssh-add returns:
        #   0 = agent running, has keys
        #   1 = agent running, no keys
        #   2 = agent not running
        ssh-add -l >/dev/null 2>&1 || [ $? -eq 1 ]
    else
        false
    fi
}

agent_has_keys() {
    ssh-add -l >/dev/null 2>&1
}

agent_load_env() {
    . "$env" >/dev/null
}

agent_start() {
    (umask 077; ssh-agent >"$env")
    . "$env" >/dev/null
}

if ! agent_is_running; then
    agent_load_env
fi

# If your keys are not stored in ~/.ssh/id_rsa or ~/.ssh/id_dsa, you'll need
# to paste the proper path after ssh-add
if ! agent_is_running; then
    agent_start
    ssh-add
elif ! agent_has_keys; then
    ssh-add
fi

unset env

This will remember my passphrase for new terminal sessions as well; I only have to type it in once when I open my first terminal after booting.

这也会记住我的新终端会话的密码；我只需要在启动后打开我的第一个终端时输入一次。

I'd like to credit where I got this; it's a modification of somebody else's work, but I can't remember where it came from. Thanks anonymous author!

我想归功于我从哪里得到的；这是对别人作品的修改，但我不记得它来自哪里。感谢匿名作者！

Update 2019-07-01:I don't think all this is necessary. I now consistently have this working by ensuring my .bash_profilefile runs the ssh-agent:

2019-07-01 更新：我认为这一切都没有必要。我现在通过确保我的.bash_profile文件运行 ssh-agent 来始终如一地工作：

eval $(ssh-agent)

Then I set up an sshconfiguration file like this:

然后我设置了一个这样的ssh配置文件：

touch ~/.ssh/config
chmod 600 ~/.ssh/config
echo 'AddKeysToAgent yes' >> ~/.ssh/config

回答by millimoose

If I understand the question correctly, you're already using an authorized SSH key in the build service, but you want to avoid having to type the passphrase for every clone?

如果我正确理解了这个问题，那么您已经在构建服务中使用了授权的 SSH 密钥，但是您想避免为每个克隆键入密码？

I can think of two ways of doing this:

我可以想到两种方法来做到这一点：

1. If your build service is being started interactively: Before you start the build service, start ssh-agentwith a sufficiently long timeout (-toption). Then use ssh-add(msysGit should have those) to add all the private keys you need before you start your build service. You'd still have to type out all the passphrases, but only once per service launch.

2. If you want to avoid having to type the passphrases out at all, you can always remove the passphrases from the SSH keys, as described in https://serverfault.com/questions/50775/how-do-i-change-my-private-key-passphrase, by setting an empty new passphrase. This should do away with the password prompt entirely, but it is even less secure than the previous option.

1. 如果您的构建服务以交互方式启动：在您启动构建服务之前，ssh-agent以足够长的超时（-t选项）启动。然后ssh-add在开始构建服务之前使用（msysGit 应该有这些）添加您需要的所有私钥。您仍然需要输入所有密码，但每次服务启动只需输入一次。

2. 如果您想完全避免输入密码，您可以随时从 SSH 密钥中删除密码，如https://serverfault.com/questions/50775/how-do-i-change-my- 中所述private-key-passphrase，通过设置一个空的新密码。这应该完全消除密码提示，但它比前一个选项更不安全。

回答by Naushad Qamar

When I tried to push my code, I got the below error:

当我尝试推送我的代码时，出现以下错误：

$ git push origin dev

remote: Too many invalid password attempts. Try logging in through the website with your password.
fatal: unable to access 'https://[email protected]/xxxx/xxxx-api.git/': The requested URL returned error: 403

After a few hours of research, I found I need to use the below command:

经过几个小时的研究，我发现我需要使用以下命令：

$ git config --global credential.helper cache

After executing the above command, I got the prompt for entering my GitHub username and password. After providing the correct credentials, I am able to push my code.

执行上述命令后，我得到了输入我的 GitHub 用户名和密码的提示。提供正确的凭据后，我就可以推送我的代码了。

回答by Manic Depression

The right solution is:

正确的解决办法是：

1. Run the Windows default terminal - cmd and get the directory of your master profile

   echo %USERPROFILE%
   

2. Run Git Bash in the directory above and create the .bashrcfile with the command

   echo "" > .bashrc
   

3. Open the .bashrcfile with your favourite text editor and paste code from GitHub Helpinto that file:

   env=~/.ssh/agent.env
   ...
   COPY WHOLE CODE FROM URL - I can't add it to Stack Overflow because it breaks layout... OMG!
   

4. Restart Git Bash and it asks you for your password (only first time) and done. No password bothering again.

1. 运行 Windows 默认终端 - cmd 并获取主配置文件的目录

   echo %USERPROFILE%
   

2. 在上面的目录中运行 Git Bash 并.bashrc使用命令创建文件

   echo "" > .bashrc
   

3. .bashrc使用您喜欢的文本编辑器打开该文件，然后将GitHub 帮助中的代码粘贴到该文件中：

   env=~/.ssh/agent.env
   ...
   COPY WHOLE CODE FROM URL - I can't add it to Stack Overflow because it breaks layout... OMG!
   

4. 重新启动 Git Bash，它会询问您的密码（仅第一次）并完成。没有密码又麻烦了。

回答by beduin

You need to create the authorized_keysfile under the .sshfolder of the user under which you are going to connect to the repository server. For example, assuming you use username buildserviceon repo.serveryou can run:

您需要在要连接到存储库服务器的用户authorized_keys的.ssh文件夹下创建文件。例如，假设您使用 username buildserviceonrepo.server您可以运行：

cd ~buidservice
mkdir ./ssh
cat id_rsa.pub >> .ssh/authorized_keys

Then you have to check the following things:

然后，您必须检查以下事项：

1. That corresponding id_rsaprivate key is presented in [email protected]:~/.shh/id_rsa.

2. That fingerprint of repo.server is stored in the [email protected]:~/.ssh/known_hostsfile. Typically that will be done after the first attempt of sshto connect to the repo.server.

1. 相应的id_rsa私钥显示在[email protected]:~/.shh/id_rsa.

2. repo.server 的指纹存储在[email protected]:~/.ssh/known_hosts文件中。通常，这将在第一次尝试ssh连接到repo.server.