Reorder files to alphabetize. Update titles to be more conducive to quick scans.

The posts have been re-dated to not only alphabetize them within their categories, but also to make them easier to find with their directory. Files marked 2008 are active post files. Files marked 2009 are outdated or are redirects to newer files. Files have been renamed to match their title for easier updating.

1 files changed, 125 insertions, 0 deletions

diff --git a/_posts/2008-02-10-ssh-key-passphrases.textile b/_posts/2008-02-10-ssh-key-passphrases.textile
new file mode 100644
index 0000000..c673220
--- /dev/null
+++ b/_posts/2008-02-10-ssh-key-passphrases.textile
@@ -0,0 +1,125 @@
+---
+layout: default
+title: SSH key passphrases
+description: SSH key passphrases, why you should use them, and how to avoid re-entering them
+categories: intermediate
+---
+
+<p class="intro">This guide will step you through the process of securing your ssh keys while avoiding re-entry of your passphrase every time you use the key.</p>
+
+h2. Why do I need a passphrase?
+
+Passwords aren't very secure, you already know this.  If you use one that's easy to remember, it's easier to guess or brute-force.  If you use one that's random it's hard to remember, and thus you're more inclined to write the password down.  Both of these are Very Bad Things&trade;.  This is why you're using ssh keys.
+
+But using a key without a passphrase is basically the same as writing down that random password in a file on your computer.  Anyone who gains access to your drive has gained access to every system you use that key with.  This is also a Very Bad Thing&trade;.  The solution is obvious, add a passphrase.
+
+h3. But I don't want to enter a long passphrase every time I use the key!
+
+Neither do I!  Thankfully, there's a nifty little tool called @ssh-agent@ that can save your passphrase securely so you don't have to re-enter it.  If you're on OSX Leopard or later your keys can be saved in the system's keychain to make your life even easier.  Most linux installations will automatically start @ssh-agent@ for you when you log in.
+
+h2. Adding or changing a passphrase
+
+Passphrases can be added to an existing key or changed without regenerating the keypair very easily:
+
+<pre class="terminal">$ ssh-keygen -p
+Enter file in which the key is (/Users/tekkub/.ssh/id_rsa):
+Key has comment '/Users/tekkub/.ssh/id_rsa'
+Enter new passphrase (empty for no passphrase):
+Enter same passphrase again:
+Your identification has been saved with the new passphrase.</pre>
+
+If your key already has a passphrase, you will be prompted to enter it before you can change to a new passphrase.
+
+h2. Auto-launching ssh-agent on msysgit
+
+You can run @ssh-agent@ automatically when you open bash by adding the following to your @~/.profile@ or @~/.bashrc@ file:
+
+{% highlight bash %}
+SSH_ENV="$HOME/.ssh/environment"
+
+# start the ssh-agent
+function start_agent {
+    echo "Initializing new SSH agent..."
+    # spawn ssh-agent
+    ssh-agent | sed 's/^echo/#echo/' > "$SSH_ENV"
+    echo succeeded
+    chmod 600 "$SSH_ENV"
+    . "$SSH_ENV" > /dev/null
+    ssh-add
+}
+
+# test for identities
+function test_identities {
+    # test whether standard identities have been added to the agent already
+    ssh-add -l | grep "The agent has no identities" > /dev/null
+    if [ $? -eq 0 ]; then
+        ssh-add
+        # $SSH_AUTH_SOCK broken so we start a new proper agent
+        if [ $? -eq 2 ];then
+            start_agent
+        fi
+    fi
+}
+
+# check for running ssh-agent with proper $SSH_AGENT_PID
+if [ -n "$SSH_AGENT_PID" ]; then
+    ps -ef | grep "$SSH_AGENT_PID" | grep ssh-agent > /dev/null
+    if [ $? -eq 0 ]; then
+	test_identities
+    fi
+# if $SSH_AGENT_PID is not properly set, we might be able to load one from
+# $SSH_ENV
+else
+    if [ -f "$SSH_ENV" ]; then
+	. "$SSH_ENV" > /dev/null
+    fi
+    ps -ef | grep "$SSH_AGENT_PID" | grep ssh-agent > /dev/null
+    if [ $? -eq 0 ]; then
+        test_identities
+    else
+        start_agent
+    fi
+fi
+{% endhighlight %}
+
+p(. *Note:* If you don't use the default key names, or store your keys in a different path, you will need to add the path to the @/usr/bin/ssh-add@ line so that ssh knows where to find your key.
+
+Now when you first run git bash, you will be prompted for your passphrase:
+
+<pre class="terminal">Initializing new SSH agent...
+succeeded
+Enter passphrase for /c/Users/Tekkub/.ssh/id_rsa:
+Identity added: /c/Users/Tekkub/.ssh/id_rsa (/c/Users/Tekkub/.ssh/id_rsa)
+Welcome to Git (version 1.6.0.2-preview20080923)
+
+
+Run 'git help git' to display the help index.
+Run 'git help <command>' to display help for specific commands.
+[Tekkub@KAKU: ~ master]$</pre>
+
+The process will continue to run until you log out, shutdown or kill ssh-agent.  To kill the process, find its PID with @ps@ then call @kill <PID>@:
+
+<pre class="terminal">[Tekkub@KAKU: ~ master]$ ps
+        PID    PPID    PGID     WINPID  TTY  UID    STIME COMMAND
+       3796       1    3796       3796    ?  500 18:07:43 /bin/ssh-agent
+       2780       1    2780       2780  con  500 18:10:50 /bin/bash
+       3400    2780    3400        784  con  500 18:13:31 /bin/ps
+[Tekkub@KAKU: ~ master]$ kill 3796</pre>
+
+p(. <em>This section was written with help from "this post":http://www.cygwin.com/ml/cygwin/2001-06/msg00537.html.</em>
+
+h2. Mac OSX Keychain
+
+If you are on OSX Leopard or later, ssh-agent is run automatically for you.  It will also integrate with the keychain, so you can unlock your keys with it.  This has some major advantages over a command-line based setup like protecting your input from being copied or spied upon by universal access or low-level keyboard routines.
+
+The default key files (@.ssh/id_rsa@, @.ssh/id_dsa@ and @.ssh/identity@) should be handled automatically.  If you have a key with a different name, you can add it with @ssh-add path/to/my_key@
+
+<p class="attention">Make sure that you're using the default OS X ssh-add command and not one installed by macports or some other external source.</p>
+
+When you first try to use the key you will be prompted to enter your passphrase:
+
+!/images/SecurityAgent.jpg(Keychain prompt)!
+
+If you choose to save the passphrase with your keychain, you won't have to enter it again.  Instead you'll simply need to unlock your keychain.
+
+<p class="attention">This section was written with help from "this guide":http://www.dribin.org/dave/blog/archives/2007/11/28/ssh_agent_leopard/.  If you would like to use more paranoid keychain settings like locking after sleep, check out "this guide":http://www.dribin.org/dave/blog/archives/2007/11/28/securing_ssh_agent/.</p>