Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

From the article: ...you can leave the password blank (if you secure your laptop with encryption, a locking screensaver, and a strong password, your SSH key doesn’t require a password)..., but what if that is still not enough security for you or your policy prohibits you from using key pairs for authentication, or maybe you are not using a server that often and just don't want to set up key pairs.

Enter the ControlMaster mechanism (see man ssh_config):

  Host *
  ControlMaster auto
  ControlPersist yes
  ControlPath /tmp/ssh-%r@%h:%p
  ServerAliveInterval 600
So now you type in your password for your first session only, and every other session will be slaved to it (this includes directory/file auto completion over ssh in zsh and other nice nibbles like it does with public/private key pairs).


Normally, your SSH auth agent is responsible for letting you unlock your key once and use it with multiple sessions.

ControlMaster's biggest advantage is using a single encryption channel for multiple connections. Especially handy if you need to jumphost through a vpn machine.


Doesn't ssh-agent do automatic pass-back, vpn or not?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: