View source for Ssh Configure Public/Private Key Authentication

=Internal=

* [[OpenSSH Operations#Client_Operations|OpenSSH Client Operations]]

=Procedure=

==Create the OpenSSH Private/Public Key Pair==

This is the procedure to generate a [[Public_Key_Security#Key_Pair|public/private key pair]]. Run the following command on the machine you will be logging '''from''' and as the Unix user you will be using to connect:

 ssh-keygen -q -b 2048 -P "" -f ~/.ssh/id_rsa -t rsa

The above command uses an empty (no) passphrase.

The key is written in [[Public_Key_Security#PEM|PEM]] format.

If you want password-less log in, use an empty string as passphrase.

The keys can also be [[Openssl_Operations#Generate_a_Public.2FPrivate_Key_Pair|generated with OpenSSL]], the results are equivalent.

For more general considerations on private keys, see: {{Internal|Public_Key_Security#Private_Key|Private Keys}}

==Permissions==

Make sure <tt>~/.ssh/id_rsa</tt> has the following permissions <tt>-rw-------</tt>.

==Install the Public Key on All Machines to Log in Into==

On all machines you will be logging in '''into''', place the content of the previously generated <tt>id_rsa.pub</tt> into  <tt>~/.ssh/authorized_keys</tt> and make sure <tt>~/.ssh/authorized_keys</tt> has the following permissions <tt>-rw-------</tt>.

Alternatively, the distribution can be done with <tt>ssh-copy-id</tt>: {{Internal|ssh-copy-id|ssh-copy-id}}

==File Permission Concerns==

Make sure <tt>~/.ssh/id_rsa</tt> is <tt>-rw-------</tt>.

Nake sure <tt>~/.ssh/authorized_keys</tt> is <tt>-rw-------</tt>.

If the home directory in which .ssh resides is world writable, pub/pvt key authentication doesn't work and ssh falls back to password.

==Configuring the Server to Allow Public Key Authentication==

<tt>/etc/ssh/sshd_config</tt> must contain the following:

<pre>
...
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile     .ssh/authorized_keys
...
</pre>

Note that I've seen server configured to use <tt>/etc/keys/%u/authorized_keys</tt>. If this is the case, place the authorized_keys file there, make it owned by the respective user and give it the appropriate permissions.

Optional: Some servers list the users allowed to authenticate with public key under the "AllowUsers" directive:

<pre>
...
AllowUsers admin jmp em
...
</pre>

=Auxiliary Procedures=

==Convert a OpenSSL PEM Public Key for Use with OpenSSH==

This command can be used to convert OpenSSL public keys generated with [[Openssl_Operations#Extract_the_Matching_Public_RSA_Key_from_a_Private_Key|openssl commands]] to a format compatible with OpenSSH.

 ssh-keygen -i -m PKCS8 -f ./id_rsa_openssl.pem > id_rsa.pub

Also see: {{Internal|Openssl_Operations#Extract_the_Matching_Public_RSA_Key_from_a_Private_Key|Extract the Matching Public RSA Key from a Private Key}}