[SOLVED] SSH connectivity

metallica1973 · 08-17-2011, 02:10 PM

So in a nutshell:

1 - ssh-keygen -t rsa --> on the ssh server itself or your client machine

This will create your id_rsa (private key) and id_rsa.pub (public key)

2 - Tell the server what your public key is:

I created this stuff on my workstation not the server hosting ssh-server:

user@client>cat .ssh/id_rsa.pub | ssh user@ssh-server "cat >> .ssh/authorized_keys"

3 - Make sure that you have stuff setup correctly in your /etc/ssh/sshd_config

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile %h/.ssh/authorized_keys

4 You should be golden from this point on.

"A private key should never ever leave any machine. When you want to exclude one you would have to give a new private key to the remaining users (besides the option to deny a user in /etc/ssh/sshd_config, but you may forget over time why it’s entered there). And in addition: all users will use the same user account? Instead each user should create a key pair and send you the public part by email or so and you enter it into their account then in case you disabled password authentication.

I also prefer to create one key pair on each machine I use, instead of copying my private key between all of them. If one gets lost for whatever event (maybe the the machine gets stolen), I only have to remove this one entry from the authorized_keys file instead of copying a new private key between the remaining machines." Taken from Reuti

Here are the urls that I used:

https://help.ubuntu.com/community/SSH/OpenSSH/Keys
http://tombuntu.com/index.php/2008/0...ssh-made-easy/

Reuti · 08-18-2011, 01:36 AM

I’m pretty sure that after 6 years this might only serve the case someone is searching for it. But:

Quote:

Originally Posted by metallica1973

I created this stuff on my workstation not the server hosting ssh-server:

user@client>cat .ssh/id_rsa.pub | ssh user@ssh-server "cat >> .ssh/authorized_keys"

can be shortened to:

Code:

user@client> ssh-copy-id ssh-server

Quote:

Originally Posted by metallica1973

Now it all about who has your private key to be able to authenticate the "ssh" server. Simply give the machines that

you want to give access to, the private key and they should be able to login into the server.

Here I disagree. A private key should never ever leave any machine. When you want to exclude one you would have to give a new private key to the remaining users (besides the option to deny a user in /etc/ssh/sshd_config, but you may forget over time why it’s entered there). And in addition: all users will use the same user account? Instead each user should create a key pair and send you the public part by email or so and you enter it into their account then in case you disabled password authentication.

I also prefer to create one key pair on each machine I use, instead of copying my private key between all of them. If one gets lost for whatever event (maybe the the machine gets stolen), I only have to remove this one entry from the authorized_keys file instead of copying a new private key between the remaining machines.

metallica1973 · 08-18-2011, 12:48 PM

Constructive criticism is always appreciated. I use this forum as my notepad. What you say makes sense. Thanks for the advice.