I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk. Using the system with some other form of authentication is not an option.
One possible solution is to talk directly to ssh-agent
and have it sign a constant token and then use, say, the signature's base64-representation as the password. This password can always be re-generated, assuming access to the private key and knowledge of the token.
https://gist.github.com/mprymek/10415576 shows that this technique is being used in the wild.
Is this approach (deriving a password from a signature) cryptographically sound?
Is this approach secure? For example, when SSH agent forwarding is used, is the signing request and response (exchanged between remote host and local ssh agent) safe from eavesdropping?
EDIT: draft-ietf-secsh-agent-02 section 4.2 says that forwarding happens through an SSH channel, and the abstract of RFC 4254 says that "channels are multiplexed into a single encrypted tunnel" which I believe means that agent forwarding is fully encrypted.
ssh_rsa_sign
) they appear to be using RSASSA-PKCS1-v1_5. $\endgroup$