Step-by-step instructions setting up RSA Authentication for SSH?
OS: Slackware 10.1
Kernel: 2.6.11.7 Openssh 3.9p1 I read the long thread on " SSH login attempts" up top, but I still don't know how to setup RSA Authentication for SSH. Thread wasn't clear enough for me to understand. One person would say do it this way, another person would say do it that way. Well I'm all confused now :( I'm looking for one way (preferably easiest) and when I do it that 'one way' it'll work right off the bat. I tried setting it up a couple of times, but with no success. So I decided to start from scratch and now here I am :) Assuming I just downloaded the newest version of OpenSSH. How would one successfully setup RSA Authentication for SSH? This thread could also help the rest of the people that want to setup RSA Authentication. --EDIT-- On the Server side, then on the client side. |
in a nutshell, all it takes is:
enable rsa authoentication in sshd_config, disable cleartext passwds Then create yourself a key to use: ssh-keygen -t rsa will guide you thru that. When you have the key generated, cp the id_rsa.pub to your ~/.ssh/authorized_keys And, take the id_rsa to every machine you need to log in from. Only when providing it upon connect, you will be allowed access. Use it with openssh via the -i switch, and from windows machines, you must convert your openssh key via puttygens importer, then use the converted key with putty. Thats as simple as I can make it, hope this helps. |
...
Thanks for your reply. I'll try it in a few. Ok, just to add: I want to replace password authentication with RSA authentication on my SSHD server. How would I go about doing that (server side and client side)? "disable cleartext passwds" I hope that means changing: # To disable tunneled clear text passwords, change to no here! PasswordAuthentication NO? |
Quote:
im in /root i did 'ssh-keygen -t rsa' then I copied irc_rsa.pub to /root/.ssh/authorized_keys, is authorized_keys a folder? or a file? |
"PasswordAuthentication no" is indeed the way to go.
"PubkeyAuthentication yes" is the actual way to allow key-based authentication. Client side, there isnt much to change if youre using OpenSSH:s client. If you have the keyfile in your ~/.ssh/id_rsa then you need not do anything differently than before. If you have it elsewhere or under another name, you need to supply it with the -i parameter. |
Quote:
|
Yay it work! Thank you for the how-to. Greatly appreciated. :cool:
|
Also, is there a way to automatically login to the SSHD server without using the '-i' switch and entering the passphrase everytime?
like what if the passphrase was pretty long? |
well, you could allways alias the command to shorten it..
The passphrase can be empty, but its not advisable. Ive had some empty keyd limited keys for automated filetransfer, so sometimes its useful.. Do note, you cant change the passphrase. Youll have to generate a new key if you want to change any of the details. |
Quote:
like what if the passphrase was 'houler'. nevermind. |
This thread explains how to use ssh-keygen to created a key for yourself. But does not your machine itself have a key which can be copied to other machines on your network so that at the linux server/clients can all recognize each other as trusted computers?
The ssh man file reads about /etc/ssh/ssh_known_hosts Quote:
maxque |
Quote:
You can also generate keys for different users. (if i'm user houler, I can generate my own key, so I can login to my own account with that key instead of using the login/password scheme) |
I did a google search and I found out that you can use ssh-agent to manage the passphrases. But the things is that once the shell that the ssh-agent is on has quit, the passphrases will be forgotten until the next ssh-agent session?
Also, I found a more convenient way which used keychain with ssh-agent but... My source: http://www.cs.utah.edu/support/faq/faq-ssh.html How do i circumvent this to make it a bit more permanent? :confused: So that when i restart the computer, I still don't have to type in my passphrase? |
if you want easier access, create a passphraseless key instead. Just hit enter when it asks for a pass.
|
Quote:
New version 1 keys: Code:
#ssh-keygen -t rsa1 -f /etc/ssh/ssh_host_key -N "" Code:
# ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N "" Watch the path names, they are different for Linux than on the NSCA site. maxque |
All times are GMT -5. The time now is 05:29 AM. |