Skip to main content
Install this machine’s Lager SSH key on a Lager Box so that lager commands and lager ssh work without a password. Run it once per box, enter the box password when prompted, and subsequent commands authenticate with the key. This wraps the ssh-keygen / ssh-copy-id dance into a single command. You can fix a Permission denied (publickey,password) error without the key path and without the ssh-copy-id incantation.
Introduced in lager 0.27.1 as lager authorize; renamed to lager ssh-setup because the old name read like authentication once lager login (gateway sign-in) arrived. The old spelling still works with a deprecation warning.

​
Syntax

​
Options

​
Usage

You are prompted for the box password once (by ssh-copy-id). After the key is installed, no further password prompts appear for that box.

​
How It Works

  1. Resolves the box name to an IP and looks up its SSH user (see SSH username resolution).
  2. Generates the key pair ~/.ssh/lager_box (and lager_box.pub) if it does not already exist.
  3. Skips the copy if already authorized — if key authentication already works for the box, it goes straight to step 6 (the command is idempotent).
  4. Copies the public key to the box with ssh-copy-id (one password prompt).
  5. Verifies that passwordless key authentication now works, reporting a clear error if it does not.
  6. Registers the public key on the box as /etc/lager/authorized_keys.d/lager-box-<user>-<host>.pub, over the key it just installed, so no extra prompt.
Step 6 is what makes the key durable rather than merely present. ssh-copy-id appends to ~/.ssh/authorized_keys outside every marker block. start_box.sh preserves such a line against its own rebuild. It cannot preserve that line against another key manager that rebuilds the file from its own source. Such a manager drops every line outside its own markers, and start_box.sh then re-creates its block from the key directory alone. A key registered in the key directory comes back; one that was only appended does not. The write is attempted unprivileged first, then with sudo -n. On a box Lager alone manages, the key directory is writable by the box user and no sudo is involved. On a box hardened by another key manager, the directory is root-owned deliberately. A writable key directory will let any user on the box authorize any key. The sudo -n fallback covers that case wherever the box user has a NOPASSWD grant broad enough. If both attempts fail, the command warns and still reports success (the key works; only its durability is lost) and prints the grant to add. Lager does not install this grant. A fleet that scopes sudo tightly is the system that made the directory root-owned. That fleet is therefore the right place to decide who can write there. Add the grant through that fleet’s own provisioning:
A sudoers wildcard does not match /, so the grant cannot reach outside the directory. The grant does not restrict which key is written, because the content is the box user’s to choose. On a box where that user is already root-equivalent, that changes nothing. On a box where the user is not root-equivalent, read the key before you add the grant.
Do not widen the key directory’s permissions instead. A writable /etc/lager/authorized_keys.d lets any user on the box authorize any key, which is exactly what a hardened box closed.
The key lives at ~/.ssh/lager_box. That filename is not one of SSH’s default identities. So lager ssh passes -i ~/.ssh/lager_box explicitly when the key exists (since lager 0.28.1), and an authorized box connects without a password.

​
Examples

​
Troubleshooting

If ssh-copy-id is unavailable, append the public key to the box manually:

​
See Also

  • SSH — open an interactive shell on a Lager Box
  • Boxes — register box names, IPs, and SSH users
  • Setting Up a Lager Box — turn an Ubuntu machine into a Lager Box