从 bash 脚本 ssh-add 并自动输入密码
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/42277977/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
ssh-add from bash script and automate passphrase entry
提问by Aishwat Singh
I am trying to do ssh-add from script (don't care about about security at the moment).
我正在尝试从脚本执行 ssh-add（目前不关心安全性）。
Now ssh prompts for passphrase, which needs to be automated, so i read couple of things like thisand found expect.
现在的密码，需要SSH提示是自动化的，所以我读几件事情像这个，发现期待。
And now i do following:
现在我执行以下操作：
eval `ssh-agent -s`
script tmp.sh defined as :
脚本 tmp.sh 定义为：
#!/usr/bin/expect
spawn ssh-add /root/.ssh/id_rsa
expect "Enter passphrase for /root/.ssh/id_rsa:"
send "my_pass"
interact
./tmp.sh
./tmp.sh
ssh-add -l
ssh-add -l
If ssh-add would have worked it shows something like
如果 ssh-add 会起作用，它会显示类似
4096 SHA256:wlfP/nhVSWXLcljBOen5GSYZXJGgfi/XJWfZeBwqRsM id_rsa (RSA)
4096 SHA256:wlfP/nhVSWXLcljBOen5GSYZXJGgfi/XJWfZeBwqRsM id_rsa (RSA)
But instead i get The agent has no identities.Seems like ssh-agent looses it's context.
但相反，我得到The agent has no identities.ssh-agent 似乎失去了它的上下文。
Am open to other solutions to do this.
我愿意接受其他解决方案来做到这一点。
回答by Jim
Personally, I find the use of expect a bit cumbersome. The following approach found how to make ssh-add read passphrase from a filerather informative.
就个人而言，我发现使用 expect 有点麻烦。以下方法发现如何使 ssh-add 从文件中读取密码短语相当有用。
So if your version of ssh-addallows the -pargument and you are not worried about security then this shouldwork:
因此，如果您的版本ssh-add允许该-p参数并且您不担心安全性，那么这应该可行：
#!/bin/bash
# store a file somewheres with your passphrase. For example's sake
# I'll just use $HOME/.myscrt
<$HOME/.myscrt ssh-add -p ~/.ssh/id_rsa
Now if -pis not an option for you, I found the second method mildly ingenious:
现在，如果-p不是您的选择，我发现第二种方法有点巧妙：
#!/bin/bash
# Same passfile and some minor enhancements from the OP of the linked
# solution
PASS="$(<$HOME/.myscrt)"
# the following is just a one-liner method of making an executable
# one-line script echoing the password to STDOUT
install -vm700 <(echo "echo $PASS") "$PWD/ps.sh"
# then the magic happens. NOTE: your DISPLAY variable should be set
# for this method to work (see ssh-add(1))
[[ -z "$DISPLAY" ]] && export DISPLAY=:0
< id_rsa SSH_ASKPASS="$PWD/ps.sh" ssh-add - && shred -n3 -uz $PWD/ps.sh
When I tested the script I called "j", see below:
当我测试我称为“j”的脚本时，请参见下文：
$ cd /tmp
$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/me/.ssh/id_rsa): /tmp/id_rsa
Enter passphrase (empty for no passphrase): asdfasdf
Enter same passphrase again: asdfasdf
Your identification has been saved in /tmp/id_rsa.
Your public key has been saved in /tmp/id_rsa.pub.
The key fingerprint is:
ed:1a:ae:c7:ac:47:5e:31:98:8e:18:8f:1c:67:94:6d jimconn@redapt-240
The key's randomart image is:
+--[ RSA 2048]----+
| o |
| o E |
| . . o |
| o o o.o |
| . O oS .o |
| + o o.. |
| =... |
| .*o |
| o=o |
+-----------------+
$ echo 'asdfasdf' > ~/.myscrt
$ chmod 0600 ~/.myscrt
$ ls -altr ~/.myscrt
-rw------- 1 me me 9 Feb 16 19:00 /home/me/.myscrt
$ cat ~/.myscrt
asdfasdf
$ ls -ltr
total 12
-rw-r--r-- 1 me me 400 Feb 16 18:59 id_rsa.pub
-rw------- 1 me me 1766 Feb 16 18:59 id_rsa
-rwx------ 1 me me 151 Feb 16 19:04 j
$ cat j
#!/bin/bash
PASS="$(<$HOME/.myscrt)"
install -vm700 <(echo "echo $PASS") "$PWD/ps.sh"
cat id_rsa | SSH_ASKPASS="$PWD/ps.sh" ssh-add - && shred -n3 -uz $PWD/ps.sh
$ ./j
‘/dev/fd/63' -> ‘/tmp/so/ps.sh'
Identity added: (stdin) ((stdin))
$ ls
id_rsa id_rsa.pub j
So, one thing to quickly note about this method is that listing the identities loaded into ssh-agentwill only show that stdinwas loaded:
因此，关于此方法需要快速注意的一件事是，列出加载的身份ssh-agent只会显示stdin已加载的身份：
$ ssh-add -D
All identities removed.
$ ssh-add -l
2048 ed:1a:ae:c7:ac:47:5e:31:98:8e:18:8f:1c:67:94:6d (stdin) (RSA)
$ ./j
‘/dev/fd/63' -> ‘/tmp/so/ps.sh'
Identity added: (stdin) ((stdin))
$ ssh-add -l
2048 ed:1a:ae:c7:ac:47:5e:31:98:8e:18:8f:1c:67:94:6d (stdin) (RSA)
回答by Samuel Kirschner
UPDATED BECAUSE THE FIRST ONE DID NOT WORK
更新，因为第一个不起作用
I did not try this, but if it is realy about expect loosing the context, it might be a good idea to set it up later:
我没有尝试过这个，但如果真的希望失去上下文，那么稍后设置它可能是一个好主意：
auto-passphrase-add.expect (replacing tmp.sh)
auto-passphrase-add.expect（替换 tmp.sh）
/usr/bin/expect
spawn ./ssh-agent-ssh-add.sh /root/.ssh/id_rsa
expect "Enter passphrase for /root/.ssh/id_rsa:"
send "my_pass"
interact
ssh-agent-ssh-add.sh
ssh-agent-ssh-add.sh
#!/bin/sh
eval `ssh-agent -s`
ssh-add "$@"
