Ssh Configure Public/Private Key Authentication: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
Line 7: Line 7:
==Create the OpenSSH Private/Public Key Pair==
==Create the OpenSSH Private/Public Key Pair==


Run the following command on the machine you will be logging '''from''' and as the Unix user you will be using to connect:
This is the procedure to generate a [[Public_Key_Security#Key_Pair|public/private key pair]]. Run the following command on the machine you will be logging '''from''' and as the Unix user you will be using to connect:


<pre>
<syntaxhighlight lang='bash'>
ssh-keygen -q -b 2048 -f ~/.ssh/id_rsa -t rsa
ssh-keygen -q -b 2048 -f ~/.ssh/id_rsa -t rsa
Enter passphrase (empty for no passphrase):  
Enter passphrase (empty for no passphrase):  
Enter same passphrase again:  
Enter same passphrase again:  
</pre>
</syntaxhighlight>


If you want password-less log in, use an empty string as passphrase.
If you want password-less log in, use an empty string as passphrase.

Revision as of 01:38, 8 April 2018

Internal

Procedure

Create the OpenSSH Private/Public Key Pair

This is the procedure to generate a public/private key pair. Run the following command on the machine you will be logging from and as the Unix user you will be using to connect:

ssh-keygen -q -b 2048 -f ~/.ssh/id_rsa -t rsa
Enter passphrase (empty for no passphrase): 
Enter same passphrase again:

If you want password-less log in, use an empty string as passphrase.

Permissions

Make sure ~/.ssh/id_rsa has the following permissions -rw-------.

Install the Public Key on All Machines to Log in Into

On all machines you will be logging in into, place the content of the previously generated id_rsa.pub into ~/.ssh/authorized_keys and make sure ~/.ssh/authorized_keys has the following permissions -rw-------.

Alternatively, the distribution can be done with ssh-copy-id:

ssh-copy-id

File Permission Concerns

Make sure ~/.ssh/id_rsa is -rw-------.

Nake sure ~/.ssh/authorized_keys is -rw-------.

If the home directory in which .ssh resides is world writable, pub/pvt key authentication doesn't work and ssh falls back to password.

Configuring the Server to Allow Public Key Authentication

/etc/ssh/sshd_config must contain the following:

...
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile     .ssh/authorized_keys
...

Note that I've seen server configured to use /etc/keys/%u/authorized_keys. If this is the case, place the authorized_keys file there, make it owned by the respective user and give it the appropriate permissions.

Optional: Some servers list the users allowed to authenticate with public key under the "AllowUsers" directive:

...
AllowUsers admin jmp em
...