2

The adb command uses ~/.android/adbkey by default.

Is there any way to specify a different key that should be used, either on a per device or per adb instance basis?

The functionality I'm looking for is similar to ssh -i /path/to/keyfile ...

I'm aware that I could just rename/move the files around or add a key to all devices but that's not the solution I'm looking for.

9
  • Shouldn't the adbkey be different on a per-device basis? Oct 26, 2015 at 18:35
  • I meant per Android device, not server device
    – arcyqwerty
    Oct 26, 2015 at 19:25
  • Yeah, I also meant per Android device. Isn't it supposed to be done with a calculation using the device serial no. And some other thimgs? Oct 27, 2015 at 3:47
  • As I understand it, the host (computer) has an RSA key which it uses to authenticate itself to the device (phone/tablet/whatever) so the user can approve debug connections. This key (and thus the fingerprint on the dialog) should be the same for any device that the host connects to.
    – arcyqwerty
    Oct 27, 2015 at 15:08
  • The device has a different adbkey. That is what helps the ab daemon to identify the device, and what shows up as the device identification code when you run adb devices, so you are getting that functionality already. Oct 27, 2015 at 16:39

1 Answer 1

0

Persistent searching found the original code change that added public-key authentication to ADB. That says:

On the host, the user public/private key pair is automatically generated, if it does not exist, when the adb daemon starts and is stored in $HOME/.android/adb_key(.pub) or in $ANDROID_SDK_HOME on windows. If needed, the ADB_KEYS_PATH env variable may be set to a :-separated (; under Windows) list of private keys, e.g. company-wide or vendor keys.

However, this does not appear to work with recent versions of adb and Android.

Experiments

I used adb 1.0.41 from platform tools 31.0.2-7242960, running on Windows 10, with a Samsung Galaxy A52s 5G running Android 12. At the start of the experiments, I had the device authorised for USB debugging, and adb shell working fine. I put the device out of my reach while leaving it connected, so that I would not enable a new key by mistake.

  1. Stop the adb server with adb kill-server and rename my .android directory as .android.original. Run adb start-server to generate a new key pair in a new .android directory, and then run adb devices to verify that the device showed up but was not authorised.

  2. Stop the adb server. Set the ADB_KEYS_PATH environment variable to the full pathname of my .android.original directory. Start the adb server, and then run adb devices. Result: Device is displayed, but not authorised.

  3. As #2, but setting ADB_KEYS_PATH to the full pathname of my .android.original\adbkey.pub file. Result: as #2.

  4. As #2, but setting ADB_KEYS_PATH to the full pathname of my .android.original\adbkey file. Result: as #2.

  5. Restore original: stop the adb server, remove my .android directory and rename the .android.original directory back to .android. Start the adb server, and then run adb devices. Result: Device is displayed, and shows as authorised.

Looking at the device screen after completing the full set of trials, it had a stack of dialogs, all offering the chance to accept the new adb key. I hit "Cancel" on all of them.

If anyone with a collection of old Android devices and old adb versions wants to experiment some more, I'd be interested to see the results. I'm reasonably satisfied that it doesn't work with modern adb.

Something that won't work

The ADB_VENDOR_KEYS environment variable is not the answer, unless you work for a device manufacturer and have access to engineering ("eng") builds of Android.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .