0.x/how-tos/ssh-key/index.html (34d65a6) - derivepassphrase.git

index.html

<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
        <meta name="description" content="An almost faithful Python reimplementation of James Coglan's vault.">
      
      
        <meta name="author" content="Marco Ricci">
      
      
        <link rel="canonical" href="https://the13thletter.info/derivepassphrase/0.x/how-tos/ssh-key/">
      
      
        <link rel="prev" href="../">
      
      
        <link rel="next" href="../../reference/">
      
      
      <link rel="icon" href="../../assets/images/favicon.png">
      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.5.42">
    
    
      
        <title>How to set up derivepassphrase vault with an SSH key - derivepassphrase</title>
      
    
    
      <link rel="stylesheet" href="../../assets/stylesheets/main.0253249f.min.css">

</a>
    </li>

<li class="md-tabs__item">
        <a href="../../tutorials/" class="md-tabs__link">
          
  
    
  
  Tutorials & Examples

</a>
      </li>

<li class="md-tabs__item md-tabs__item--active">
        <a href="../" class="md-tabs__link">
          
  
    
  
  How-Tos

</a>
      </li>

<li class="md-tabs__item">
        <a href="../../reference/" class="md-tabs__link">
          
  
    
  
  Reference

</a>
      </li>

<li class="md-tabs__item">
      <a href="../../changelog/" class="md-tabs__link">
        
  
    
  
  Changelog

</a>
    </li>

</ul>
  </div>
</nav>
          
        
      
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">

</a>
    derivepassphrase
  </label>
  
    <div class="md-nav__source">
      <a href="https://github.com/the-13th-letter/derivepassphrase" title="Go to repository" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81"/></svg>
  </div>
  <div class="md-source__repository">
    the-13th-letter/derivepassphrase
  </div>
</a>
    </div>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
      
  
  
  
  
    <li class="md-nav__item">
      <a href="../.." class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Overview
  </span>

</a>
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2" >
        
          
          
          <div class="md-nav__link md-nav__container">
            <a href="../../tutorials/" class="md-nav__link ">
              
  
  <span class="md-ellipsis">
    Tutorials & Examples
  </span>

</a>
            
              
              <label class="md-nav__link " for="__nav_2" id="__nav_2_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2">
            <span class="md-nav__icon md-icon"></span>
            Tutorials & Examples
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../tutorials/basic-setup-passphrase/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Setting up derivepassphrase vault for three accounts, with a master passphrase
  </span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

</a>
            
              
              <label class="md-nav__link " for="__nav_3" id="__nav_3_label" tabindex="">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="true">
          <label class="md-nav__title" for="__nav_3">
            <span class="md-nav__icon md-icon"></span>
            How-Tos
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
            
              
                
  
  
    
  
  
  
    <li class="md-nav__item md-nav__item--active">
      
      <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
      
      
        
      
      
        <label class="md-nav__link md-nav__link--active" for="__toc">
          
  
  <span class="md-ellipsis">
    How to set up derivepassphrase vault with an SSH key
  </span>

<span class="md-nav__icon md-icon"></span>
        </label>
      
      <a href="./" class="md-nav__link md-nav__link--active">
        
  
  <span class="md-ellipsis">
    How to set up derivepassphrase vault with an SSH key
  </span>

</a>

<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
  
    
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#prerequisites" class="md-nav__link">
    <span class="md-ellipsis">
      Prerequisites
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#configuring-derivepassphrase-vault-to-use-an-ssh-key" class="md-nav__link">
    <span class="md-ellipsis">
      Configuring derivepassphrase vault to use an SSH key
    </span>
  </a>
  
</li>
      
    </ul>
  
</nav>
      
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4" >
        
          
          
          <div class="md-nav__link md-nav__container">
            <a href="../../reference/" class="md-nav__link ">
              
  
  <span class="md-ellipsis">
    Reference
  </span>

</a>
            
              
              <label class="md-nav__link " for="__nav_4" id="__nav_4_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4">
            <span class="md-nav__icon md-icon"></span>
            Reference
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
            
              
                
  
  
  
  
    
    
      
        
      
        
      
        
      
        
      
    
    
      
      
        
      
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_2" >
        
          
          <label class="md-nav__link" for="__nav_4_2" id="__nav_4_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Man pages
  </span>

<span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4_2">
            <span class="md-nav__icon md-icon"></span>
            Man pages
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../reference/derivepassphrase.1/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    derivepassphrase(1)
  </span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase-vault.1/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    derivepassphrase-vault(1)
  </span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase-export.1/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    derivepassphrase-export(1)
  </span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase-export-vault.1/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    derivepassphrase-export-vault(1)
  </span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_3" >
        
          
          <label class="md-nav__link" for="__nav_4_3" id="__nav_4_3_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    API docs: Module derivepassphrase
  </span>

<span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_3_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4_3">
            <span class="md-nav__icon md-icon"></span>
            API docs: Module derivepassphrase
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../reference/derivepassphrase.cli/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Submodule cli
  </span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase.exporter/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Subpackage exporter
  </span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase.sequin/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Submodule sequin
  </span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase.ssh_agent/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Submodule ssh_agent
  </span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase._types/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Submodule _types
  </span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase.vault/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Submodule vault
  </span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_4" >
        
          
          <label class="md-nav__link" for="__nav_4_4" id="__nav_4_4_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Technical prerequisites
  </span>

<span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4_4">
            <span class="md-nav__icon md-icon"></span>
            Technical prerequisites
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../reference/prerequisites-ssh-key/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Using derivepassphrase vault with an SSH key
  </span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item">
      <a href="../../changelog/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Changelog
  </span>

</a>
    </li>

</ul>
</nav>
                  </div>
                </div>
              </div>
            
            
              
              <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">

<h1 id="how-to-set-up-derivepassphrase-vault-with-an-ssh-key">How to set up <code>derivepassphrase vault</code> with an SSH key<a class="headerlink" href="#how-to-set-up-derivepassphrase-vault-with-an-ssh-key" title="Permanent link">&para;</a></h1>
<div class="admonition abstract">
<p class="admonition-title">See also</p>
<p>→ Tradeoffs between a master passphrase and a master SSH key (TODO)</p>
</div>
<h2 id="prerequisites">Prerequisites<a class="headerlink" href="#prerequisites" title="Permanent link">&para;</a></h2>
<div class="admonition abstract">
<p class="admonition-title">Further reading</p>
<p>→ Full technical details: <a href="../../reference/prerequisites-ssh-key/">Prerequisites for using <code>derivepassphrase
vault</code> with an SSH key</a></p>
</div>
<ol>
<li>A running SSH agent; typically provided by OpenSSH or PuTTY.</li>
<li>A Python installation that can talk to the SSH agent.</li>
<li>A supported SSH key; typically an RSA, Ed25519 or Ed448 key.</li>
</ol>
<h2 id="configuring-derivepassphrase-vault-to-use-an-ssh-key">Configuring <code>derivepassphrase vault</code> to use an SSH key<a class="headerlink" href="#configuring-derivepassphrase-vault-to-use-an-ssh-key" title="Permanent link">&para;</a></h2>
<p>Assuming the prerequisites are satisfied, ensure that the SSH agent is
running, the SSH key is loaded into the agent, and the <code>SSH_AUTH_SOCK</code>
environment variable is correctly set up.  The exact commands depend on
the SSH agent in use.</p>
<div class="tabbed-set tabbed-alternate" data-tabs="1:3"><input checked="checked" id="__tabbed_1_1" name="__tabbed_1" type="radio" /><input id="__tabbed_1_2" name="__tabbed_1" type="radio" /><input id="__tabbed_1_3" name="__tabbed_1" type="radio" /><div class="tabbed-labels"><label for="__tabbed_1_1">OpenSSH</label><label for="__tabbed_1_2">PuTTY</label><label for="__tabbed_1_3">GnuPG</label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<div class="highlight"><span class="filename">Typical setup commands: starting the agent and setting up SSH_AUTH_SOCK</span><pre><span></span><code><span class="gp">$ </span><span class="nb">eval</span><span class="w"> </span><span class="sb">`</span>ssh-agent<span class="w"> </span>-s<span class="sb">`</span>
<span class="go">Agent pid 12345</span>
</code></pre></div>
<p>(The process ID emitted above is helpful for signalling the agent
later, e.g. for termination.)</p>
<div class="highlight"><span class="filename">Typical setup commands: loading the key into the agent, with 900s timeout and requiring confirmation</span><pre><span></span><code><span class="gp">$ </span>ssh-add<span class="w"> </span>-t<span class="w"> </span><span class="m">900</span><span class="w"> </span>-c<span class="w"> </span>~/.ssh/my-vault-ed25519-key
<span class="go">Enter passphrase for /home/user/.ssh/my-vault-ed25519-key (will confirm each use): </span>
<span class="go">Identity added: /home/user/.ssh/my-vault-ed25519-key (vault key)</span>
<span class="go">Lifetime set to 900 seconds</span>
<span class="go">The user must confirm each use of the key</span>
</code></pre></div>
<p>(Your key filename and key comment will likely differ.)</p>
</div>
<div class="tabbed-block">
<div class="highlight"><span class="filename">Typical setup commands: starting the agent and loading the key</span><pre><span></span><code><span class="gp">$ </span><span class="nb">eval</span><span class="w"> </span><span class="sb">`</span>pageant<span class="w"> </span>-T<span class="w"> </span>~/.ssh/my-vault-ed25519-key.ppk<span class="sb">`</span>
<span class="go">Enter passphrase to load key &#39;vault key&#39;: </span>
</code></pre></div>
<p>(Your key filename and key comment will likely differ.  The agent
should automatically shut down once this terminal session is over.)</p>
</div>
<div class="tabbed-block">
<div class="highlight"><span class="filename">Typical setup commands: enabling SSH agent support in GnuPG</span><pre><span></span><code><span class="gp">$ </span><span class="c1"># This is equivalent to passing --enable-ssh-support upon agent</span>
<span class="gp">$ </span><span class="c1"># startup.</span>
<span class="gp">$ </span><span class="nb">echo</span><span class="w"> </span>enable-ssh-support:0:1<span class="w"> </span><span class="p">|</span><span class="w"> </span>gpgconf<span class="w"> </span>--change-options<span class="w"> </span>gpg-agent
</code></pre></div>
<p>(Loading native SSH keys into <code>gpg-agent</code> requires a separate SSH
agent client such as OpenSSH; see the <a href="../../reference/prerequisites-ssh-key/#agent-specific-notes">agent-specific notes in the
prerequisites</a>.)</p>
<div class="highlight"><span class="filename">Typical setup commands: loading the key into the agent with the OpenSSH tools</span><pre><span></span><code><span class="gp">$ </span>ssh-add<span class="w"> </span>-c<span class="w"> </span>~/.ssh/my-vault-ed25519-key
<span class="go">Enter passphrase for /home/user/.ssh/my-vault-ed25519-key (will confirm each use): </span>
<span class="go">Identity added: /home/user/.ssh/my-vault-ed25519-key (vault key)</span>
<span class="go">The user must confirm each use of the key</span>
</code></pre></div>
<p>(Your key filename and key comment may differ.)</p>
</div>
</div>
</div>
<p>Next, configure <code>derivepassphrase vault</code> to use the loaded SSH key.</p>
<div class="tabbed-set tabbed-alternate" data-tabs="2:2"><input checked="checked" id="__tabbed_2_1" name="__tabbed_2" type="radio" /><input id="__tabbed_2_2" name="__tabbed_2" type="radio" /><div class="tabbed-labels"><label for="__tabbed_2_1">global key</label><label for="__tabbed_2_2">key specifically for <var>SERVICE</var></label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--config<span class="w"> </span>-k
<span class="go">Suitable SSH keys:</span>
<span class="go">[1] ssh-rsa ...feXycsvJZ2uaYRjMdZeJGNAnHLUGLkBscw5aI8=  test key without passphrase</span>
<span class="go">[2] ssh-ed448 ...BQ72ZgtPMckdzabiz7JbM/b0JzcRzGLMsbwA=  test key without passphrase</span>
<span class="go">[3] ssh-ed25519 ...gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2  test key without passphrase</span>
<span class="go">Your selection? (1-3, leave empty to abort): 3</span>
</code></pre></div>
<p>(The prompt text will be &ldquo;Use this key?&rdquo; instead if there is only one
suitable key.)</p>
<p>Now <code>derivepassphrase vault</code> will automatically use the configured
key globally, even without the <code>-k</code>/<code>--key</code> option.</p>
</div>
<div class="tabbed-block">
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--config<span class="w"> </span>-k<span class="w"> </span>SERVICE
<span class="go">Suitable SSH keys:</span>
<span class="go">[1] ssh-rsa ...feXycsvJZ2uaYRjMdZeJGNAnHLUGLkBscw5aI8=  test key without passphrase</span>
<span class="go">[2] ssh-ed448 ...BQ72ZgtPMckdzabiz7JbM/b0JzcRzGLMsbwA=  test key without passphrase</span>
<span class="go">[3] ssh-ed25519 ...gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2  test key without passphrase</span>
<span class="go">Your selection? (1-3, leave empty to abort): 3</span>
</code></pre></div>
<p>(The prompt text will be &ldquo;Use this key?&rdquo; instead if there is only one
suitable key.)</p>
<p>Now <code>derivepassphrase vault</code> will automatically use the configured
key for <var>SERVICE</var>, even without the <code>-k</code>/<code>--key</code> option.</p>
</div>
</div>
</div>
<div class="admonition abstract">
<p class="admonition-title">Further reading</p>
<p>→ Tradeoffs between a master passphrase and a master SSH key,
section &ldquo;Should I use one master SSH key, or many keys?&rdquo; (TODO)</p>
</div>

</article>
            </div>
          
          
        </div>
        
      </main>
      
        <footer class="md-footer">
  
    
      
      <nav class="md-footer__inner md-grid" aria-label="Footer" >
        
          
          <a href="../" class="md-footer__link md-footer__link--prev" aria-label="Previous: How-to overview">
            <div class="md-footer__button md-icon">
              
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
            </div>
            <div class="md-footer__title">
              <span class="md-footer__direction">
                Previous
              </span>
              <div class="md-ellipsis">
                How-to overview
              </div>
            </div>
          </a>
        
        
          
          <a href="../../reference/" class="md-footer__link md-footer__link--next" aria-label="Next: Reference overview">
            <div class="md-footer__title">
              <span class="md-footer__direction">
                Next
              </span>
              <div class="md-ellipsis">
                Reference overview
              </div>
            </div>
            <div class="md-footer__button md-icon">
              
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg>
            </div>
          </a>
        
      </nav>
    
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
    <div class="md-copyright__highlight">
      Copyright &copy; 2024 Marco Ricci (the-13th-letter)
    </div>
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
    and
    <a href="https://mkdocstrings.github.io/python/" target="_blank" rel="noopener">
        mkdocstrings-python
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      
    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    
    
    
    
  </body>
</html>

derivepassphrase.git

Deployed 21da667f0ed6 to 0.x with MkDocs 1.6.1 and mike 2.1.3