Install ssh keychain on Ubuntu with WSL

opensshserversshssh-agentwindows-subsystem-for-linux

Please help me understand how to install SSH keychain on my Ubuntu under WSL in order for me to be able to configure my .ssh/config to use it.

I'm taking some online training, and I've tried setting up my config file like the instructor (who is using Metatron CLI), using Usekeychain, but it does not recognise that as a valid setting:

Host*
    AddKeysToAgent Yes
    UseKeychain Yes
    IdentityFile ~/.ssh/[his githubfile]

But when I tried login into my server it said UseKeychain is not a command. Since then, I've since been trying to find how to add my key to my keychain and how to setup my config file.

Best Answer

Part of your problem, at least, is that UseKeychain is a MacOS-specific configuration option which instructs it to add the unlocked key to the MacOS Keychain (part of that OS that can store it securely). So we can assume that your instructor is on a Mac. It sounds like the Mac version of ssh will read the OS keychain, which is typically unlocked on first use across the whole OS. My understanding is that there are equivalents under Ubuntu, like Gnome Keyring, but this won't work under WSL.

So let's start with the fact that you'll need to remove that MacOS-specific configuration option under Ubuntu, at least.

If your instructor is providing that config file to students as an example, they really should do it properly with:

Host*
    IgnoreUnknown UseKeychain    
    AddKeysToAgent Yes
    UseKeychain Yes
    IdentityFile ~/.ssh/[his githubfile]

That would allow it to work both on a Mac as well as the (90%+) rest of the world.

Under WSL Ubuntu, you will need to enter the passphrase at least once in each session to add it to ssh-agent. If you run multiple shell instances, you'll typically need a new ssh-agent invocation in each shell.

Alternatively, you can install Funtoo keychain which can (more) easily set up the connection to ssh-agent in each shell instance. This can allow you to only need to enter the passphrase once as long as the WSL instance is working.

sudo apt-get install keychain

And add something like the following to your ~/.bashrc:

eval `keychain --eval --agents ssh id_rsa`

See the official keychain website for full instructions.

Please note, once the WSL Ubuntu instance terminates (wsl -l -v shows "Stopped") then the passphrase will need to be entered again on next use.

Related Question