opkssh-renewer

README

opkssh-renewer

This is a wrapper for opkssh to renew certificates and (re-)add them to a running ssh-agent.

By default, if the expected key/certificate is not found or is older than 23-hours it will be renewed by running "opkssh login".

Command Line Options

The following command line options are supported:

• --debug - Enable debug logging
• --force - Force the renwwal of identity even if it is not required
• --maxage - Age of identity before renewal is required (default 23h)
• --name - Name of identity file(s) (default id_opkssh)

Process

Running opkssh-renewer performs the following steps:

1. Short lived SSH key/certificate generated by "opkssh" is checked for age (by default "~/.ssh/id_opkssh")
2. If this file is older than 23-hours the "opkssh login" process is started to generate a new identity to a temporary directory (by default "~/.ssh/opksshXXXXXX/")
3. Assuming this completes the resulting key/certificate are added to the "ssh-agent"
4. The old identity is removed from the "ssh-agent"
5. The new identity files are moved into place

Requirements

Windows

1. The "OpenSSH Agent" Windows service must be set to "Manual" startup
2. Run "ssh-agent.exe"

Linux

The SSH agent must be running and the "SSH_AUTH_SOCK" environment variable must be set:

eval 'ssh-agent -s'

Using with PuTTY

As PuTTY has it's own SSH agent implementatation (Pageant), you must use a bridge between the two protocols such as https://github.com/ndbeals/winssh-pageant.

This implementation will allow PuTTY to use keys added to the native Windows ssh-agent.