Advanced

Setting up public key authentication for SSH

Posted by GradysGhost on · 13 comments
Linuxphilia; By Ryan J. Jung 		Mail this story
Print this story

If you're like me, you remote into a handful of servers using SSH all the time. The process is fairly simple: Get to a terminal, ssh username@hostname, Type password, Get to work.. No, it's not terribly difficult, but when you have to type that password fifty times per day, you begin to realize that it's time-consuming and repetitive. And there happens to be a way to eliminate that step from the process.

If you're like me, you remote into a handful of servers using SSH all the time. The process is fairly simple:

Get to a terminal ssh username@hostname Type password Get to work No, it's not terribly difficult, but when you have to type that password fifty times per day, you begin to realize that it's time-consuming and repetitive. And there happens to be a way to eliminate that step from the process.

The SSH protocol supports authentication by public keys, and setting this up is a trivial matter. The configuration process goes something like this:

Generate a key for your client system Put it on the server One prerequisite: your SSH server must have public key authentication enabled. This is usually the case by default, but if you want to check, you can look in your /etc/ssh/sshd_config file. Try this:

grep 'PubkeyAuth' /etc/ssh/sshd_config

If the output is

PubkeyAuthentication yes

then you're safe to continue. Otherwise, you'll have to make the change in that file and restart the SSH server. There are a few ways to accomplish this, and I won't go into them here because it's not the point.

The point is that once this is ready, you can create your RSA key on the client machine. This is the first step toward getting this done. On the client machine, run

ssh-keygen -t rsa

You'll be asked for a filename. Just press enter to accept the default, which is probably ~/.ssh/id_rsa

You'll also be asked for a passphrase. You can use this optionally. If the point is to eliminate having to enter a password with every SSH connection, it's best to supply no passphrase. You'll also be asked to confirm it.

When done, you'll get a printout of your fingerprint and you'll return to a prompt.

Now we need to check this file's permissions. We don't want any other users to be able to read this pubkey file lest they compromise your authentication.

chmod 600 ~/.ssh/id_rsa.pub

Finally, copy your public key to the server as a specific filename.

scp ~/.ssh/id_rsa.pub username@server:~/.ssh/authorized_keys

Make sure the authorized_keys file has the same permissions so it won't be compromised.

The next time you log in from this client machine, you won't be asked for your password.

Full Story

  Nav
» Read more about: Story Type: Tutorial; Groups: Linux

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (13)

Bob_Robertson ·
Security certainly is inconvenient. And convenience is insecure.

My reason for using public key authentication was to be able to turn off passwords, and make things that much harder for a cracker. With this, if someone compromises your desktop system, they get access to all the rest without a password, too.

I can understand it, but I have to wonder if a simple password isn't better than no password at all.

Everything is a trade-off.
gus3 ·
I'd argue that a simple password is worse than none. A simple password gives a false sense of security; no password makes the lack of security very obvious. Kind of like how people without car insurance on average are better drivers.
Bob_Robertson ·
Compromise one system or compromise one password.

I'd rather that there be a reasonably secure password that gets written down, since anyone who can get in and physically read the post-it note is going to have physical access to the machine and then all bets are off anyway.

This may be a good place for pinentry to be utilized by ssh, so that the single-sign-on can be accomplished with a reasonably secure password/phrase without having to enter it many times.

I started using PGP when it first hit the 'Net, so I've seen a lot of supposed "security" come and go.
jhansonxi ·
A password manager with a strong encryption key makes security easy. All of my accounts use random keys that are stored in KeePassX.
Bob_Robertson ·
http://www.keepassx.org/

Let's see if it is linked to passwords in Kwalletmanager, Icewoozle, ssh and gpg...

Thanks, JH.
jhansonxi ·
It's not but that doesn't bother me. It is still useful for storing the SSH private key passphrase. On Ubuntu, Seahorse is integrated with GPG, network share passwords, and wireless keys.
mrider ·
My ssh private key is protected by a 30+ character nonsensical (but not gibberish) pass phrase. I use keychain and ssh-askpass to store the key for me at log in. Anyone with a copy of my private key could log into a large number of systems, but they'd have to crack the pass phrase to do so. And yet I can log into a system with my public key without supplying a huge password each time.

I find that to be relatively convenient, and yet it would be fairly non-trivial to brute-force my private key pass phrase...
jezuch ·
I recently started formulating my passwords in Lojban. Easier to remember than random gibberish but looks the same, especially if you assume the space-less, accented style (something like "loDJEdiNUZba") ;)
jdixon ·
> My ssh private key is protected by a 30+ character nonsensical (but not gibberish) pass phrase.

I wonder if anyone has ever actually used the pass phrase supercalifragilisticexpialidocious?
Bob_Robertson ·
> I wonder if anyone has ever actually used the pass phrase supercalifragilisticexpialidocious?

They will now.
tracyanne ·
I won't, I'd have to keep coming back here to find out how to spell it.
Bob_Robertson ·
I mean in dictionary attacks.

I even had to look up "squirrel" for the SQL database thread because I couldn't spell it.
hkwint ·
jd: Hey, how did you know? Now I'll have to reset all my pw's!

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post