30

I am new to the MacBook and I am running El Capitan.

I'm migrating my machine usage from a PC to a MacBook. I am long time user of PuTTY and SuperPuTTY on a PC.

I want to create and save login credentials to my web servers in MacBook Terminal just like I've done in SuperPuTTY on the PC.

Is it possible to save web server login credentials in Mac Terminal?

Here is My Overall Objective:

I would like to know if there is an easy way in Mac Terminal to store the following command line login credentials and then use some sort of a shortcode to connect to my web server through Terminal:

ssh -p 2200 root@123.456.789.012
Password: ****************************************************************

I manage and connect to 5 different web servers so sorting out and organizing the login credentials in a short/fast connection method would be a huge time saver. Especially because my passwords are cryptic 64-character strings.

  • I've purged the comments as Tammy's edit version three knocked this out of the park in terms of clarity and usefulness. Well done! – bmike Oct 10 '15 at 14:18
46

You can copy your public key to the remote machines. As long as they have public key authentication enabled, and your public key is present on the remote machine, you can ssh to the machines without having to supply a password.

First you'll need to generate a public/private keypair like so:

ssh-keygen -t rsa

Follow the prompts. When it asks if you want to protect the key with a passphrase say YES! It's bad practice to not password-protect your keys and I'll show you how to only have to enter the password once in a while.

If you already have keypair you can skip the step above.

Now, assuming your ssh key exists on your Mac as ~/.ssh/id_rsa.pub, you can install it on a remote machine by running:

cat ~/.ssh/id_rsa.pub | ssh user@123.45.56.78 "mkdir -p ~/.ssh && cat >>  ~/.ssh/authorized_keys"

For your specific server example cited above, the command would look like:

cat ~/.ssh/id_rsa.pub | ssh -p 2200 root@123.456.789.012 "mkdir -p ~/.ssh && cat >>  ~/.ssh/authorized_keys"

You'll have to enter the password for root@123.456.789.012 to perform this copy, but this should be the last time you need to do this. Assuming the remote server's sshd is setup to do public-private key authentication, when you ssh to the box now it shouldn't ask you for a password for the root account -- instead it'll ask you for the password for your key. Read on for how to make this something you don't need to enter all the time.

Repeat the above for every machine you want to ssh in to with your keys instead of a password.

Please note, anyone who gets a hold of your ~/.ssh/id_rsa file can ssh to this machine as root without supplying a password for the remote machine. Password protecting the key file ensure they'd need to know the password for that key to use it. Make sure that file is secure. Use disk encryption on your Mac and keep the permissions on the file and the ~/.ssh/ directory tight.

To make it easier to use the key without having to enter the password every time, OS X runs an ssh-agent process in the background on your machine. This agent will cache the keypair the first time you use it so you only have to enter your password once in a while. If you only sleep your mac, never restart it, you can go long periods of time without needing to enter your password.

You can pre-cache all your SSH keys with the ssh-agent by running:

ssh-add

Now you only need to remember the key password, not the many different account passwords. I usually keep my key passwords in 1Password (no affiliation), further simplifying how many passwords I need to remember. Then I just look them up in 1Password and cut-and-paste them in the Terminal the odd time I restart my Mac and cause my running ssh-agent to be restarted.

If you combine copying your key to remote machines with the Terminal.app connection management solution in this question, you'll have something very close to PuTTY for GUI connection experience.


On the server side, check /etc/ssh/sshd_config and make sure:

PubkeyAuthentication yes

is enabled in the configuration (it is by default in OpenSSH). You may also wish to set:

PasswordAuthentication no

While you're there so password-based authentication is disabled and keys become the only way to access the machine.

You'll need to restart sshd on the machine if you make any changes to the configuration file.

  • Thanks @IamC - this answer is great and I am sure will work. I created a stack exchange account here on the Mac Channel this morning to see if I could find a quick and easy way to save login credentials in Terminal or on the Mac somehow. It looks like doing so is extremely complicated and not a viable solution for me. Here's why: <more> – tammy Oct 9 '15 at 18:41
  • <cont.> I have command line access to a number of web servers (5 in all). I have a desktop PC at my work office with SSH (via PuTTY) access to these web servers. I have a large laptop PC at my home office with SSH (via PuTTY) access to these web servers. I just bought a MacBook Air for travel and on-site client visits. It's perfect for that particular need. I was hoping to make SSH connections to the servers as easy as it is through PuTTY and SuperPuTTY on the PC. <more> – tammy Oct 9 '15 at 18:41
  • <cont.> But I cannot go through the public auth key route because I would need to change the way PuTTY works on my home and work office PC's. It has become too daunting of a task to make the Mac work like my PC's so I think I will just have to stick with the copy & paste process for connecting from my Mac. Thank you for your help. I greatly appreciate your helping me try to make my process simpler. – tammy Oct 9 '15 at 18:42
  • 2
    @tammy you can leave PasswordAuthentication yes on the server-side and PuTTY will continue to function as it always has on your Windows machine. This isn't an either/or scenario -- you can allow both types of authentication on the server. PuTTY also supports public/private key authorization like this FWIW. You can copy your ~/.ssh/id_rsa* files to your Windows machine and import them in to PuTTY for authentication to the server. PuTTY, under the hood, uses the exact same OpenSSH libraries to connect as ssh on OS X. – Ian C. Oct 9 '15 at 18:43
  • 1
    ssh-add still works even in Sierra (OS X 10.12). Thanks – SaxDaddy Sep 26 '16 at 18:08
3

You can use sshpass to save the password and won't have to insert everytime which isn't a good practice (security issues).

Follow the instructions for mac os x installation on : https://gist.github.com/arunoda/7790979

When you have sshpass installed run sshpass -p "YOUR_PASSWORD" ssh -o StrictHostKeyChecking=no root@123.456.789.012:2200

do the same thing for your 5 web servers and you won't need to insert the password everytime.

  • 1
    I feel way too dumb on this one. I guess using a PC with PuTTY and SuperPuTTY just distanced me too far from the base command line. I edited my OQ with my overall objective. Have a look. – tammy Oct 9 '15 at 16:22
  • I'm assuming now that you can get connected to root@123.456.789.012 and just want to automate the process. You basically don't want to type each time ssh -p 2200 root@123.456.789.012 and Password: ********************** ? – enzo Oct 9 '15 at 16:30
  • ssh-copy-id isn't part of the standard OS X distribution. – Ian C. Oct 9 '15 at 16:30
  • @IanC. I think i forgot that i installed it with brew. will modify my answer – enzo Oct 9 '15 at 16:32
  • You got it @maetsoh -- that's exactly what I want to achieve here. – tammy Oct 9 '15 at 16:33
1

In addition to the public/private key stuff, the .ssh/config file can be configured to ease use of ssh commands, like aliases, defaut user/port per server, ssh options, proxy commands...

Basically anything complicated you can put in a ssh command can be in this file too.

0

I have ported Putty to Mac as a native application bundle, so no need for macports or terminals if your not a technical user.

More information with screen-shots is here : http://www.wine-reviews.net/2016/08/putty-for-mac-os-x-now-available.html

Cheers,

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • Welcome to Ask Different! Be sure to answer the question directly. If I you mention a product you work on, that's fine, but try to be on topic as opposed to pasting the same marketing blurb on multiple posts. – bmike Aug 31 '16 at 20:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .