I'm on a Mac (OSX).I've accidentally deleted my ssh keys, but I haven't restarted my computer yet so I'm still able to access servers with my key. I guess the ssh-agent has some form of it in memory?Is there any way to retrieve the key from the ssh-agent?I still remember the password etc.
Deleted my ssh keys
ssh;ssh agent;core dump;dump
Depends on how much time you have. If you know C than the safest way is to connect with gdb to the ssh-agent process (must be root) and print the key data. Identity keys are stored in an array called idtable which contains a linked list of identities. So, you can print the BIGNUM data (as defined in (1)) like:(gdb) call BN_bn2hex(idtable[2]->idlist->tqh_first->key->rsa->n)where the number 2 is the version (you probably need 2) and the last element is one of the BIGNUM (the rest are engine, e, d, p, q, dmp1, dmq1, iqmp). Now to use this data you need to write a small utility program where you define a RSA struct (defined as in (1)) and populate them. Probably you could write another utility program to do this automatically but then you need more time, you can just print the data manually. Then you call the PEM_write_RSAPrivateKey (2) function with the above RSA data and you have a new unencrypted rsa file.Sorry for not having more details but if you have time it could be a starting point.(1) /usr/include/openssl/rsa.h(2) see man page for pem(3)