Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using OSX 10.8 on my macbook air, i have git configured to push my repository to an EC2 instance via ssh. Everything works fine with that.

The only issue is that after every reboot, I have to ssh-add certname.pem in order to allow GIT to connect to my ec2 instance over SSH.

I am not sure if this is just an overlooked configuration issue, or if there is a more indepth reason for this.

share
comments disabled on deleted / locked posts

locked by Iain Aug 24 '12 at 13:08

4 Answers

Why not just set up a key with no password and have git/ssh use that key as its SSH IdentityFile?
(although ssh-keygen asks you for a passphrase when you generate a key you can just hit enter and the resulting key won't require a passphrase to use).

Since you want to automatically re-add this key you're bypassing any security that using a key would give you anyway, so there's no practical difference between a passwordless key and one that the agent automatically imports.


Obviously you don't want this key to be able to do anything except access your git server (in case someone gets their hands on the private half of the key you don't want them running commands as you!)

share
    
There is not a password on the Cert, i am just using the one i setup the ec2 instance with. is that bad practice? –  Eric Cumbee Aug 24 '12 at 0:11
add comment

Hmmm. This is an unfortunate interaction with EC2's ssh design. You're strongly encouraged to use pem files to reach instances, hence why you ssh -i <aws.pem> in all their connectivity examples...

How about a git alias? I haven't tested this, as I don't have an EC2 instance at which to push, but something like:

git config alias.ec2push "!sh -c 'ssh-add certname.pem && git push $1 $2'"

Then you'd push with:

git ec2push <repo> <branch>
share
    
My comment was lost when this got migrated from SO, but faced with this problem I'd use one of the other answers before this one. I'm leaving it up in case anyone finds it useful, but personally I'd rather deal with the keys than with an alias. –  Christopher Aug 27 '12 at 13:33
add comment

Can't you use

ssh-add -K [keyfile]

to add the info to your Keychain? Then it will be there next time you start a terminal while authed to that keychain

share
    
That did the trick. so ssh-add only adds the cert for the length of the session. While -K adds it to the OSX keychain and persistent across multiple sessions? –  Eric Cumbee Aug 24 '12 at 3:57
add comment

What you need is to setup script to add the pem to OSX's keychain add below line to your ~/.bash_profile (or ~/.zshrc if you are using zsh)

ssh-add -K certname.pem

Check out this http://superuser.com/a/409316/41202 for more details

share
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.