ssh_public_key_authentication

SSH Public Key Authentication

These instructions attempt to explain the basic concepts of SSH Public Key Authentication, what it is, and the steps required to use it.

Logging in with SSH key authentication means that you do not have to use your SDF account password. Instead, you generate a 'key' – which is two long strings of characters stored in a pair of files – and these files are used to verify that you are who you say you are. Since your key can reliably identify you, you can authorize the user of this key (you, hopefully) to log in to your SDF account. You can authorize any key you wish, and adding someone's key would allow them to log in to your SDF account, without even using or knowing your password.

This may sound insecure or easily exploitable. In fact though, due to much research and theory, it can be very secure. Notice “can be” in that last sentence. The key files are taking the place of a password in proving to the server that you're really you. Just like you have to keep passwords secret, the strength of this method relies on you following certain guidelines. You will generate a pair of mathematically related keys: one public and the other private. You should never give out your private key, nor should you make the file that contains it readable by any other user. This would be like storing your password in a world-readable file. Only your *public* key will be listed on the server. Ensuring that your private key remains private is the most important of the guidelines that I mentioned. On to the instructions:

Windows instructions:

You will need an SSH client and a key generator for Windows. These instructions are written for the popular programs PuTTY and PuTTYgen. Both are available at www.chiark.greenend.org.uk/~sgtatham/putty/download.html.

Run PuTTYgen. At the bottom of the window, you can select which type of key you want to generate. You will need to pick between RSA and DSA encryption: go with RSA – the relevant website is here: the.earth.li/~sgtatham/putty/0.53b/htmldoc/Chapter8.html#8.2.2 . Your choice will have no effect on the rest of the steps here. For current applications, 1024 bits is plenty for a key to have. If youre feeling paranoid, 2048 bits should (barring any revolutions in prime factoring) keep your key secure for a decade or two.

Now press Generate and wave your mouse around to seed some randomness in the key generator. Viola, you have a key.

You can then add a passphrase to your key, and use just that one passphrase whenever you log in to an ssh server using your key. Alternately you can use no passphrase. Be aware though that if you don't have to use a password to login from your computer, then neither would anyone else that sits down at your computer or otherwise accesses your local account.

The key comment is for your personal convenience, I reccomend youruser@yourlocalmachine and maybe the date, but of course it's up to you. Now save both the private and public key file somewhere (My Documents is a good choice, but pick somewhere that only *you* will have read access to.)

Next, you need to configure PuTTY to use this key. Fire up PuTTY and load your session or create a new one. Then in the Category list on the left, selecct Connection > SSH > Auth. Browse for your key and load it up. Also, you'll want to allow changes of username if your SDF account name is different from your local one.

You're almost done! Now you need to let the server know about your new key. After you do this, the ssh, scp and sftp programs will use the key files automatically. So (optionally, but it is recommended) save your session, and then connect. Now do the following to authorize your key:

0. Copy the contents in the Key Generator window (“Public key for pasting into OpenSSH authorized_keys file”)

1. Log in as normal and run the following commands.

2. $ mkdir ~/.ssh

3. $ cd ~/.ssh/

4. $ touch authorized_keys

5. Open the authorized_keys file you just created in a text editor.

6. Paste the contents of that box in to the authorized_keys file. In PuTTY, right click copies and pastes.

7. Save the authorized_keys file.

You should now be able to log in using SSH Key Authentication.

I succeeded somewhat differently. In my trial, public key should be rather copied not from the saved public key, but from Public key for pasting into OpenSSH authorized_keys file: textbox in the PuTTYgen window. Note that we can also extract from existing PuTTYgen-type private keys (just load into it, and the public key should be there.).

OpenSSH instructions:

You can get OpenSSH at www.openssh.com or through package installers like rpm or apt-get. There are versions for most major non-Windows operating systems (and even one for Cygwin.) Once you have the OpenSSH suite set up, the program you will need to run is “ssh-keygen -t”. The -t option is required, and specifies the type of encryption algorithm used in generating a key. You should use RSA encryption to generate your key – the relevant website is here: the.earth.li/~sgtatham/putty/0.53b/htmldoc/Chapter8.html#8.2.2 .

you@yourcomputer:~ $ ssh-keygen -t rsa

You can then add a passphrase to your key, and use this passphrase whenever you log in to an SSH-enabled server. Alternately you can use no passphrase. Be aware though that if you don't have to use a password to login from your user account, then neither would anyone else that sits down at your computer or otherwise accesses your local account.

You now have two new files in the ~/.ssh/ directory. These files are your public and private key and will be named id_rsa.pub and id_rsa respectively. The ssh, scp and sftp programs use these files automatically. To enable the server to recognize your key, follow these steps: