2

I have a github account that I would like to push to on a regular basis from an Amazon ec2 instance. In order to connect to the github account I have an SSH key that's passphrase protected, so in order to push to or pull from github I have to enter in my passphrase from the command line. The problem is that I'm trying to write a cron script to push certain files to github every day in the morning, which makes the passphrase entering problematic.

From what I understand researching so far, in order to automate the passphrase entry for the rsa_id I need to add the passphrase to an ssh-agent, and also use a keychain (if I'm misunderstanding please let me know!) Although I was able to figure out how to add the passphrase to an ssh-agent, I've run into a problem with the keychain part of the process. Keychain doesn't appear to come installed on the ec2 server, and when I tried to run "yum install keychain" I got an error saying that there wasn't an available repository for it. I searched online and saw that the repository (RPMForge) seems to be available for CentOS and RHEL distributions, but I'm hesitant to install on EC2 (which is Amazon AMI Linux) not knowing if it'll work, or even potentially cause issues for the system.

If anyone knows if this is safe to do, or if I'm moving in the right direction it would be much appreciated, thanks very much!

4
  • You could just remove the passphrase from the ssh key. Jul 17, 2015 at 16:17
  • @Michael Hamptom --- I considered doing that, but github seemed to suggest that it's not a safe/secure practice (?) so I was trying to see if there's a way to keep the passphrase. That said, I do sort of wonder how much safer it is adding it to an ssh-agent and using keychain in comparison.
    – Zero Wing
    Jul 17, 2015 at 16:41
  • You do need to understand the security issues, of course. Anyone who gets access to that user - or root - on your instance could then access the keypair and start pushing to your github account. Just saying it's "NOT SAFE OMGOMGOMG" is not very helpful of them. But if you want to put this in a cron job, it's pretty much your only choice. You should, of course, use a completely different keypair for this, so that if it is compromised you can just revoke it from github. Jul 17, 2015 at 16:43
  • @MichaelHampton fast forward 6 years would you say that your approach still makes the most sense or are there any other ways now? There doesn't seem to be much other advice around for what seems like a pretty normal thing to want to do.
    – Joseph
    Nov 3, 2021 at 14:16

0

You must log in to answer this question.

Browse other questions tagged .