I kind of hate openssh

[sweenish]

So, my situation is the following:

I am running Windows 10, but have a Debian WSL set up. For work, I need to connect to the same cluster (it goes through a jump host), using different accounts that fall into two groups. One is a general access account, the remaining are specialized.

The specialized accounts were set up with RSA keys (using a passphrase), and they have the default names id_rsa and id_rsa.pub. I have those configured just fine, thanks to the default name fallback.

The part that makes this stupid, is that I am perfectly fine typing my passphrase to connect to the specialized accounts on demand. The reasons for this are: I use the WSL terminal in VS Code and I don't want to be bothered entering my passphrase just so I can compile and debug code.

I was using the same key pair for my general access account, but decided I should have different keys. And because this was general access, I wanted a lazy login. So I created a new RSA key pair with no passphrase.

My initial config involved adding a scriptlet to .bashrc to add this new key to ssh-agent. That worked great. But now my specialized accounts won't fall back to the default key, and are instead asking for a password. Again, I don't want to pre-load the specialized account key because I don't want to bothered typing the passphrase if I bring up a terminal for "not going to ssh" reasons.

IdentitiesOnly yes (with proper IdentityFile for each host)in the global space of my .ssh/config only partially works. I get prompted for my specialized passphrases, but then it goes on to ask me for a password, so it doesn't completely work.

I know that from the terminal, I can just ssh -i KEYHOST_ALIAS, but that's tedious. This should not be so difficult.

And while I'm sure I've been butting my head due to my own lack of knowledge of the inner workings of openssh, they didn't have to make it so obtuse. I feel like what I want to do is not so crazy or weird.

 

[sweenish]

Here's a cleaned up version of my .ssh/config

# following text must be added to your local ~/.ssh/config file
IdentitiesOnly yes
# This is my general access account
Host [aliases]
ProxyCommand ssh USERNAME@JUMP_HOST ballast %h
User USERNAME
IdentityFile  FULL_PATH_TO_GENERAL_KEY
Compression yes
ServerAliveInterval 60
HostKeyAlias ADDRESS

Host SPECIALIZED_ALIASES
ProxyCommand ssh SPEC_USERNAME@JUMP_HOST ballast %h
User SPEC_USERNAME
PubkeyAuthentication yes
IdentityFile  FULL_PATH_TO_SPEC_KEY
Compression yes
ServerAliveInterval 60
HostKeyAlias ADDRESS

 

[sweenish]

And here's the snippet from my .bashrc

# Set up ssh-agent                                                                                                SSH_ENV="$HOME/.ssh/environment"                                                                                                        function start_agent {
       echo "Initializing new SSH agent..."
       touch $SSH_ENV
       chmod 600 "${SSH_ENV}"
       /usr/bin/ssh-agent | sed 's/^echo/#echo/' >> "${SSH_ENV}"
       . "${SSH_ENV}" > /dev/null
       /usr/bin/ssh-add FULL_PATH_TO_GENERAL_KEY
}

# Source SSH settings, if applicable
if [ -f "${SSH_ENV}" ]; then
       . "${SSH_ENV}" > /dev/null
       kill -0 $SSH_AGENT_PID 2>/dev/null || {
       start_agent
    }
else
       start_agent
fi

I'll be on a Mac in a few months, and getting keychain/keyring going will alleviate all of this, but at this moment, it's just so stupid.