I have a db-driven application that needs to communicate with another server via ssh. The web app can generate a keypair and give the user the pubkey, or it can accept the unencrypted private key in a field on a web form. It then encrypts the key with reversible encryption and stores it in its database.When the web app goes to communicate with the ssh server, I need to unencrypt the private key and provide it to ssh some way or another. I could create a secure temporary file with mktemp, point ssh at it, and then destroy the file, but that's extra work that exposes the key in a new way that seems like it shouldn't be necessary. I've looked at man ssh, man ssh-agent and man ssh-add, but there doesn't seem to be any way to use the key without adding it to a file first. What am I missing?
Must I store a private key in a file?
ssh;key authentication;ssh agent
If you want to use the existing tools like ssh/ssh-agent you have to provide the key as a file.Another, maybe more feasible solution is to either directly implement a ssh client within your application and depend on third party libraries such as JSch or extend either ssh/ssh-agent to directly receive and decrypt the key from your database.