Bug 2714 - Allow specifying a key description when loading from stdin
Summary: Allow specifying a key description when loading from stdin
Status: CLOSED WORKSFORME
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh-add (show other bugs)
Version: 7.5p1
Hardware: All All
: P5 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-08 00:47 AEST by Sascha Silbe
Modified: 2021-04-23 15:01 AEST (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sascha Silbe 2017-05-08 00:47:01 AEST
As a work-around for #2713, we're currently loading a private key file from stdin with ssh-add:

ssh-add - < foo/id_rsa

The key will end up as an "anonymous" entry in "ssh-add -l" output:

sascha.silbe@twin:~$ ssh-add -l
2048 d8:9f:1f:cc:f6:7b:d9:cb:ad:43:6c:c8:ea:13:09:4f Sascha Silbe <sascha-pgp@silbe.org> (RSA)
4096 79:22:5b:b8:3c:d1:f4:b0:95:df:0a:8e:43:10:75:d3 rsa w/o comment (RSA)

This makes it hard for humans to distinguish / recognise the keys and is potentially confusing.

Since loading keys from stdin is likely useful in more cases than just as a work-around for #2713, it would be good to have an option to specify a description when adding a key.
Comment 1 Jakub Jelen 2017-05-09 17:00:13 AEST
The private key (in old format) does not have the comment in the file structure, nor the ssh-add knows the filename of the private key to pick the comment from the associated public key (by adding the .pub to the filename).

You can simply use the new OpenSSH format, which has the comment embedded and works in this use case flawlessly:

$ ssh-keygen -t rsa -o -f id_rsa
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in id_rsa.
Your public key has been saved in id_rsa.pub.
The key fingerprint is:
SHA256:a70xCiekGbgR7bJdVQk/BUykE21q/jqD7TggnYNmLmY jjelen@jjelen.redhat.com
The key's randomart image is:
+---[RSA 2048]----+
|        o*=o.    |
|   .     ==.     |
|  . .   +oo      |
|   +   .o. .     |
|  +oo.ooS        |
|  =*=*  .o       |
| +o.+ooo+.+      |
|.E.   o*+..+     |
|o.    .o++.      |
+----[SHA256]-----+
$ eval `ssh-agent`
Agent pid 10614
$ ssh-add - < id_rsa
Identity added: (stdin) (jjelen@jjelen.redhat.com)
$ ssh-add -l
2048 SHA256:a70xCiekGbgR7bJdVQk/BUykE21q/jqD7TggnYNmLmY jjelen@jjelen.redhat.com (RSA)
Comment 2 Sascha Silbe 2018-07-07 19:40:24 AEST
After using "-o" with every ssh-keygen operation (setting comment, changing/removing passphrase), at least ssh-agent now shows the comment, thanks. gpg-agent in SSH emulation mode still only shows "rsa w/o comment" but that may be a problem with gpg-agent rather than the OpenSSH client.
Comment 3 Damien Miller 2021-04-23 15:01:27 AEST
closing resolved bugs as of 8.6p1 release