Re: OpenSSH ssh-keygen and non-empty passphrase

From: Bill Marcum (bmarcum_at_iglou.com.urgent)
Date: 05/25/05 

Date: Wed, 25 May 2005 16:02:13 -0400

On 25 May 2005 07:11:33 -0700, bnies@bluewin.ch
  <bnies@bluewin.ch> wrote:
>
> Or: As an alternative one can write a wrapper script that checks for
> the passphrase. But ssh-keygen seems only to accept a passphrase as
> command argument and not from standard input. This is unsafe because in
> the moment of generating a new SSH keypair one can see the passphrase
> when doing a 'ps -ef'.
>
You could write a script using expect to input the passphrase. 

-- 
Depend on the rabbit's foot if you will, but remember, it didn't help
the rabbit.
		-- R.E. Shay

Relevant Pages

  • Re: OpenSSH ssh-keygen and non-empty passphrase
    ... > command argument and not from standard input. ... This is unsafe because in ... > the moment of generating a new SSH keypair one can see the passphrase ...
    (comp.security.ssh)
  • Re: ssh-keygen empty passphrase
    ... the command won't read anything from ... standard input. ... "Enter passphrase(empty for no passphrase): ...
    (comp.security.ssh)
  • OpenSSH ssh-keygen and non-empty passphrase
    ... empty passphrases and configure the minimal length of a passphrase? ... Reading the new passphrase from standard input or setting global ... passphrase policies for ssh-keygen would be a good feature. ...
    (comp.security.ssh)