12

I have a server I just opened. When I ssh as nt_deployer, it asks me for an ssh passphrase:

Nets-Mac-Pro:mysite emai$ ssh [email protected]
Enter passphrase for key '/Users/emai/.ssh/id_rsa': 
[email protected]'s password: 
Welcome to Ubuntu 14.04 LTS (GNU/Linux 3.13.0-29-generic x86_64)

However, when I ssh as emai, it doesn't ask:

Nets-Mac-Pro:mysite emai$ ssh [email protected]
[email protected]'s password: 
Welcome to Ubuntu 14.04 LTS (GNU/Linux 3.13.0-29-generic x86_64)

Can someone tell me how I would stop the passphrase prompt from popping up for nt_deployer?

Improve this question
3
  • I ran ssh-keygen and it worked
    – bigpotato
    Jul 18, 2014 at 21:12
  • Please post your solution, and mark it as an answer - that stops ServerFault being left with "un-answered" questions that don't need any help.
    – TessellatingHeckler
    Jul 18, 2014 at 21:37
  • When you ran ssh-keygen, you likely destroyed the previous key. Are you aware of why you even had one?
    – Valmiky Arquissandas
    Jul 19, 2014 at 1:11

2 Answers 2

Reset to default
4

This line Enter passphrase for key '/Users/emai/.ssh/id_rsa': means that your key is protected by a password entered when that key was generated every time you use it it will ask for a password.

by running ssh-keygen one more time without entering the password you've generated another key. No password in the key - no password prompt :)

here is quote from ssh-keygen manpage:

Normally this program generates the key and asks for a file in which to store the private key. The public key is stored in a file with the same name but ``.pub'' appended. The program also asks for a passphrase. The passphrase may be empty to indicate no passphrase (host keys must have an empty passphrase), or it may be a string of arbitrary length. A passphrase is similar to a password, except it can be a phrase with a series of words, punctuation, numbers, whitespace, or any string of characters you want. Good passphrases are 10-30 characters long, are not simple sentences or otherwise easily guessable (English prose has only 1-2 bits of entropy per character, and provides very bad passphrases), and contain a mix of upper and lowercase letters, numbers, and non-alphanumeric characters. The passphrase can be changed later by using the -p option.

There is no way to recover a lost passphrase. If the passphrase is lost or forgotten, a new key must be generated and the corresponding public key copied to other machines.

Improve this answer
5
  • I've found that SSH will prompt for a passphrase if it has trouble reading the private key. I gave it an empty file, and it asked for a passphrase.
    – makhdumi
    Apr 22, 2015 at 17:17
  • 1
    That means you need to execute ssh -v to see the actual error, usually it is permissions problem, as the key file must have 0600 permissions.
    – stimur
    Apr 22, 2015 at 20:49
  • It could also be that the user doesn't own the key file. This often happens while copying the keys from other users.
    – Rusty Weber
    May 28, 2015 at 18:43
  • @stimur 400 should be sufficient
    – 030
    May 15, 2017 at 12:06
  • 2
    Warning: at least on my OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n 7 Dec 2017, openssh will ask for a passphrase even on a key that doesn't have a passphrase if there is no newline after the -----END OPENSSH PRIVATE KEY----- - just adding a newline after that makes it stop asking for a passphrase, weird stuff.
    – hanshenrik
    Apr 28, 2020 at 18:10
3

Building on stimur's answer, yes, ssh is asking for a key's passphrase. Which means you are using a key in the first place.

If that is what you want - a private key protected with a passphrase, you can use ssh-agent to remember the passphrase (or the decrypted private key, I'm not sure which one), so that you can login without typing the passphrase again. You can remember it indefinitely, or for a fixed amount of time.

man ssh-agent and man ssh-add!

Improve this answer
4
  • what if I run ssh-agent, ssh-add and after running ssh command it still asks passphrase? And when I enter the passphrase, it even ask password, because it thinks that passphrase is wrong probably? If passphrase is wrong then ssh-add command would also not accept it.
    – Darius.V
    Apr 21, 2015 at 12:19
  • Darius: either the passphrase is wrong, or you've got more than one key. Try the ssh -v option.
    – Valmiky Arquissandas
    Apr 21, 2015 at 12:22
  • I tried -vvv. After it asks passphrase - it says "no passphrase give, try next key". But pashprhase is empty string, so I just hit enter. Then it writes "we did not send a packet, disable method" and "authmethod_lookup password" and after few messages it asks password. Tried entering '' and enter, then it says - bad passphrase. And I have more than one key, one is with passphrase, another is without passprase. But I pass to ssh command -i id_rsa and it should know that I use one without passphrase
    – Darius.V
    Apr 21, 2015 at 12:26
  • @Darius.V: you can specify key explicitly by -i /path/to/key and check verbose output of ssh, plus verify permissions for the key file. Please make sure you're using public key, not private.
    – stimur
    Apr 22, 2015 at 20:52

Not the answer you're looking for? Browse other questions tagged .