Keychain - Revision history

Flavius: gpg -k command

2013-04-11T15:57:06Z

gpg -k command

Flavius: GPG instructions

2013-04-11T15:54:55Z

GPG instructions

Drobbins: /* Clearing Keys */

2012-12-27T03:33:44Z

‎Clearing Keys

Drobbins: /* Stopping Agents */

2012-12-27T03:33:25Z

‎Stopping Agents

Drobbins: /* Generating a Key Pair */

2012-12-27T03:28:50Z

‎Generating a Key Pair

Drobbins: /* Linux */

2012-06-22T20:16:48Z

‎Linux

Godmachine81: /* Setting up Authentication */

2012-03-14T16:47:45Z

‎Setting up Authentication

Drobbins at 17:32, 10 February 2011

2011-02-10T17:32:39Z

Ferdy: added HOWTO and Projects categories

2011-02-10T08:54:56Z

added HOWTO and Projects categories

Ferdy: first release (cat, pandoc and paste from http://www.funtoo.org/en/security/keychain/intro)

2011-02-10T08:49:31Z

first release (cat, pandoc and paste from http://www.funtoo.org/en/security/keychain/intro)

Show changes

@@ Line 133: / Line 133: @@
 Keychain can ask you for your GPG passphrase if you provide it the GPG key ID. To find it out:
 <console>
 pub   2048R/DEADBEEF 2012-08-16
 uid                  Name (Comment) <email@host.tld>
@@ Line 145: / Line 146: @@
 source ~/.ssh/.keychain/$HOST-sh-gpg
 </console>
 == Learning More ==

← Older revision		Revision as of 15:54, 11 April 2013
Line 128:		Line 128:

	<console># ##i##keychain -k mine</console>		<console># ##i##keychain -k mine</console>
		+
		+	== GPG ==
		+
		+	Keychain can ask you for your GPG passphrase if you provide it the GPG key ID. To find it out:
		+	<console>
		+	pub 2048R/DEADBEEF 2012-08-16
		+	uid Name (Comment) <email@host.tld>
		+	sub 2048R/86D2FAC6 2012-08-16
		+	</console>
		+
		+	Note the '''DEADBEEF''' above is the ID. Then, in your login script, do your usual
		+
		+	<console>
		+	keychain --dir ~/.ssh/.keychain ~/.ssh/id_rsa DEADBEEF
		+	source ~/.ssh/.keychain/$HOST-sh
		+	source ~/.ssh/.keychain/$HOST-sh-gpg
		+	</console>
		+
		+
		+
		+

	== Learning More ==		== Learning More ==

@@ Line 113: / Line 113: @@
 Sometimes, it might be necessary to flush all cached keys in memory. To do this, type:
-<pre>keychain --clear</pre>
+<console># ##i##keychain --clear</console>
 Any agent(s) will continue to run.

@@ Line 124: / Line 124: @@
 If you want to stop all agents, which will also of course cause your keys/identities to be flushed from memory, you can do this as follows:
-<pre>keychain -k all</pre>
+<console># ##i##keychain -k all</console>
 If you have other agents running under your user account, you can also tell <tt>keychain</tt> to just stop only the agents that <tt>keychain</tt> started:
-<pre>keychain -k mine</pre>
+<console># ##i##keychain -k mine</console>
 == Learning More ==

@@ Line 50: / Line 50: @@
 To use RSA and DSA authentication, first you use a program called <tt>ssh-keygen</tt> (included with OpenSSH) to generate a ''key pair'' -- two small files. One of the files is the ''public key''. The other small file contains the ''private key''. <tt>ssh-keygen</tt> will ask you for a passphrase, and this passphrase will be used to encrypt your private key. You will need to supply this passphrase to use your private key. If you wanted to generate a DSA key pair, you would do this:
-<pre># ssh-keygen -t dsa
+<console># ##i##ssh-keygen -t dsa
-Generating public/private dsa key pair.</pre>
+Generating public/private dsa key pair.</console>
 You would then be prompted for a location to store your key pair. If you do not have one currently stored in <tt>~/.ssh</tt>, it is fine to accept the default location:
-<pre>Enter file in which to save the key (/root/.ssh/id_dsa): /var/tmp/id_dsa</pre>
+<console>Enter file in which to save the key (/root/.ssh/id_dsa): </console>
 Then, you are prompted for a passphrase. This passphrase is used to encrypt the ''private key'' on disk, so even if it is stolen, it will be difficult for someone else to use it to successfully authenticate as you with any accounts that have been configured to recognize your public key.
@@ Line 61: / Line 61: @@
 Below, I have supplied a passphrase so that my private key file will be encrypted on disk:
-<pre>Enter passphrase (empty for no passphrase):
+<console>Enter passphrase (empty for no passphrase): ##i#########
-Enter same passphrase again:
+Enter same passphrase again: ##i#########
 Your identification has been saved in /var/tmp/id_dsa.
 Your public key has been saved in /var/tmp/id_dsa.pub.
@@ Line 78: / Line 78: @@
 |        . o . =o*|
 |         . E .+*.|
-+-----------------+</pre>
++-----------------+</console>
 == Setting up Authentication ==

@@ Line 26: / Line 26: @@
 === Linux ===
-To install under Gentoo or Funtoo Linux, type <tt>emerge keychain</tt>. For other Linux distributions, use your distribution's package manager. Then generate RSA/DSA keys if necessary. The quick install docs assume you have a DSA key pair named <tt>id_dsa</tt> and <tt>id_dsa.pub</tt> in your <tt>~/.ssh/</tt> directory. Add the following to your <tt>~/.bash_profile</tt>:
+To install under Gentoo or Funtoo Linux, type <tt>emerge keychain</tt>. For other Linux distributions, use your distribution's package manager, or download and install using the source tarball above. Then generate RSA/DSA keys if necessary. The quick install docs assume you have a DSA key pair named <tt>id_dsa</tt> and <tt>id_dsa.pub</tt> in your <tt>~/.ssh/</tt> directory. Add the following to your <tt>~/.bash_profile</tt>:
 <pre>eval `keychain --eval --agents ssh id_dsa`</pre>

@@ Line 85: / Line 85: @@
 Then, if you weren't going to use <tt>keychain</tt>, you'd perform the following steps. On your local client, you would start a program called <tt>ssh-agent</tt>, which runs in the background. Then you would use a program called <tt>ssh-add</tt> to tell <tt>ssh-agent</tt> about your secret private key. Then, if you've set up your environment properly, the next time you run <tt>ssh</tt>, it will find <tt>ssh-agent</tt> running, grab the private key that you added to <tt>ssh-agent</tt> using <tt>ssh-add</tt>, and use this key to authenticate with the remote server.
-Again, the steps in the previous paragraph is what you'd do if <tt>keychain</tt> wasn't around to help. If you are using <tt>keychain</tt>, and I hope you are, you would simply add the following line to your <tt>~/.bash_profile</tt>:
+Again, the steps in the previous paragraph is what you'd do if <tt>keychain</tt> wasn't around to help. If you are using <tt>keychain</tt>, and I hope you are, you would simply add the following line to your <tt>~/.bash_profile</tt> or if a regular user to<tt>~/.bashrc</tt> :
 <pre>eval `keychain --eval id_dsa`</pre>
-The next time you log in or source your <tt>~/.bash_profile</tt>, <tt>keychain</tt> will start, start <tt>ssh-agent</tt> for you if it has not yet been started, use <tt>ssh-add</tt> to add your <tt>id_dsa</tt> private key file to <tt>ssh-agent</tt>, and set up your shell environment so that <tt>ssh</tt> will be able to find <tt>ssh-agent</tt>. If <tt>ssh-agent</tt> is already running, <tt>keychain</tt> will ensure that your <tt>id_dsa</tt> private key has been added to <tt>ssh-agent</tt> and then set up your environment so that <tt>ssh</tt> can find the already-running <tt>ssh-agent</tt>. It will look something like this:
+The next time you log in or source your <tt>~/.bash_profile</tt> or if you use <tt>~/.bashrc</tt>, <tt>keychain</tt> will start, start <tt>ssh-agent</tt> for you if it has not yet been started, use <tt>ssh-add</tt> to add your <tt>id_dsa</tt> private key file to <tt>ssh-agent</tt>, and set up your shell environment so that <tt>ssh</tt> will be able to find <tt>ssh-agent</tt>. If <tt>ssh-agent</tt> is already running, <tt>keychain</tt> will ensure that your <tt>id_dsa</tt> private key has been added to <tt>ssh-agent</tt> and then set up your environment so that <tt>ssh</tt> can find the already-running <tt>ssh-agent</tt>. It will look something like this:
 Note that when <tt>keychain</tt> runs for the first time after your local system has booted, you will be prompted for a passphrase for your private key file if it is encrypted. But here's the nice thing about using <tt>keychain</tt> -- even if you are using an encrypted private key file, you will only need to enter your passphrase when your system first boots (or in the case of a server, when you first log in.) After that, <tt>ssh-agent</tt> is already running and has your decrypted private key cached in memory. So if you open a new shell, you will see something like this:

← Older revision		Revision as of 17:32, 10 February 2011
Line 1:		Line 1:
−	~~= Introduction to Keychain =~~
−
−	~~; keywords~~
−	~~: keychain, funtoo, gentoo, Daniel Robbins~~
−	~~; description~~
−	:
−
−	~~<blockquote>This page contains information about Keychain, an OpenSSH and commercial SSH2-compatible RSA/DSA key management application.~~
−	~~</blockquote>~~
−	~~; version~~
−	~~: 2010.05.07~~
−	~~; author~~
−	~~: Daniel Robbins~~
−	~~; copyright~~
−	~~: funtoo~~
−	~~; language~~
−	~~: English~~
−
	== Introduction ==		== Introduction ==

← Older revision		Revision as of 08:54, 10 February 2011
Line 168:		Line 168:

	In mid-July, 2009, Daniel Robbins migrated Aron's mercurial repository to git and set up a new project page on funtoo.org, and made a few bug fix commits to the git repo that had been collecting in [http://bugs.gentoo.org bugs.gentoo.org]. Daniel continues to maintain <tt>keychain</tt> and supporting documentation on funtoo.org, and plans to make regular maintenance releases of <tt>keychain</tt> as needed.		In mid-July, 2009, Daniel Robbins migrated Aron's mercurial repository to git and set up a new project page on funtoo.org, and made a few bug fix commits to the git repo that had been collecting in [http://bugs.gentoo.org bugs.gentoo.org]. Daniel continues to maintain <tt>keychain</tt> and supporting documentation on funtoo.org, and plans to make regular maintenance releases of <tt>keychain</tt> as needed.
		+
		+	[[Category:HOWTO]]
		+	[[Category:Projects]]