Yesterday, I learned that security/pam-ssh-agent-auth is abandoned and deprecated.
Looking back, I first used this about 13 years ago, and wrote about it while describing how I set up ansible clients.
Today, I tried one of the two recommended replacement:
- security/pam_rssh – mentioned by Romain Tartière
- security/pam_ssh_agent – the one I’m trying
Very much a drop-in replacement
Here’s what I did.
Install it:
The following 1 package(s) will be affected (of 0 checked): New packages to be INSTALLED: pam-ssh-agent: 0.9.7 [local] Number of packages to be installed: 1 The process will require 1 MiB more space. 413 KiB to be downloaded. Proceed with this action? [y/N]: y [empty.int.unixathome.org] [1/1] Fetching pam-ssh-agent-0.9.7: 100% 413 KiB 422.5 kB/s 00:01 Checking integrity... done (0 conflicting) [empty.int.unixathome.org] [1/1] Installing pam-ssh-agent-0.9.7... [empty.int.unixathome.org] [1/1] Extracting pam-ssh-agent-0.9.7: 100%
What did it install?
[11:32 empty dvl ~] % pkg info -l pam-ssh-agent pam-ssh-agent-0.9.7: /usr/local/lib/pam_ssh_agent.so
Adjust /usr/local/etc/pam.d/sudo:
#auth sufficient /usr/local/lib/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys auth sufficient /usr/local/lib/pam_ssh_agent.so file=~/.ssh/authorized_keys auth required pam_deny.so account include system session required pam_permit.so
The commented out line is the old. The new line is the second line.
That’s it. Nothing to restart…
However, there is more to this configuration than shown. That did not need to be modified for this. See the “Configure ssh agent auth for sudo” section of this post.
I did delete the deprecated package: sudo pkg delete pam_ssh_agent_auth
