I've got an Amazon EC2 compute instance with Ubuntu 11.04 running on it. I've managed to get my root key (the "ubuntu" user actually) set up so that I can SSH in from both my windows machine and my Ubuntu desktop.

The issue I'm having is that I'm trying to set up a git repository on this server to be accessed via SSH by a team of developers. I've created the first user, "jason" but jason cannot log using the password I created for him because SSH on the server is set up to require a key file. I believe that's due to this setting in /etc/ssh/sshd_config:
I've got a few questions:
1) Can I allow users to login by setting that to "yes" and restarting ssh? Is this safe? Will passwords be transmitted as cleartext? What about root/ubuntu who (afaik) don't have any password yet -- are those accounts safe?

2) If it's not safe, what steps are required to allow "jason" to login with a certificate? Obviously I need a key file but I tried using the key file that I created for the ubuntu/root user (when I created the compute instance) and it apparently doesn't work for "jason" -- it only works for "ubuntu". What are the steps? Where does the file go? Does it need to be stored on both the client and the server? Or does the server have a public key and the client have a private key?

3) How hard is it to set up my devs (using Windows, OSX, and linux) each with keys so that their various git clients (git-gui, gitk, git, TortoiseGit, eGit, etc) can interact with the repository via ssh? Do the clients need to know where the key file lives or do they just use ssh and ssh needs to know where the key file is?

Any help would be much appreciated.

Passwords will not be transmitted in plain text. In general you should disable root logins over ssh with the following entry in your /etc/ssh/sshd_config
Get "jason" to give you his public key and then put it in his .ssh/authorized_keys file.

How hard is it? Depends on how competent they are. The clients shouldn't need to care about what authentication (password/rsa/dsa etc) ssh is using.

Cheers,

Evo2.

Greetings,

Yes, you can do all that without a problem. SSH creates a secure channel, through which it sends all packets. That's why you don't have to worry about security much. However, if I were you, I would check twiсe your hosts for root-kits and viruses - keyboard loggers can still intercept data from keyboard.

Next, you can set your SSH port to something not standard (it could be 22981 or any other port that is not reserved for existent software). You can also set your SSH server to listen from certain IP addresses / subnets. Check "ListenAddress" directive and look through ssh manual.

Then you can turn "root" login off. That means that only unprivileged users can log in and attempt to log in with root credentials will result in error. After you log in with your standard account, you can use "sudo" (you can assign permissions for every person / group / host in "/etc/sudoers" in a way you like your users to behave) to differentiate every person or you can log in with "root" credentials using the same "sudo" program.

You can also set your SSH server to accept SSH certificates. Doing that way will free you (and your fellow devs) from retyping your password every time they logging in. However, that could be a possible security hole as anyone with ill intentions can access your server without a password asked. That's up to you.

Summarizing that short ssh security review, I would advice to check ssh manual and Google articles.

More reading here:
http://www.linuxproblem.org/art_9.html
http://ubuntuforums.org/showthread.php?t=1132821

Best regards,
Konstantin

thank you for your responses. it's a relief to know that passwords are not transmitted as clear text. thanks for the good advice.

I have managed to get my Ubuntu desktop to connect to the remote server using keys. This page worked perfectly. However, I must repeat those steps for each developer on my team -- and, more importantly, they have to be able to use their various git clients (TortoiseGIT, git-gui, eGit, etc.) to use ssh to interact with my central git repository. I'm wondering how tough it will be to generate a cert file for each dev, distribute them all, and configure all those clients.

Please check the first link in my previous post.

Best regards,
Konstantin

You don't generate keys for your devs: they do it then they send you the their public keys and you put them in the corresponding ~/.ssh/authorized_keys file for each user. You do not need their private keys and should not know their passphrases.

Also, the link you posted seems to advocate using dsa however it is current wisdom (please google if you want more info) that rsa is the better option.

Regarding the different git front ends, I can't say anything specific since I only use the standard command line git, but if a front end does not support using ssh, then IMNSHO it probably shouldn't be used.

Cheers,

Evo2.

Konstantin, the link you had in your post -- as far as I can tell -- is specific to a *nix machine. At least 2 of my devs will be running windows systems which will not support those commands. Additionally, windows doesn't natively support SSH afaik ... one must download puTTY for an SSH session and I'm not really sure how the various git clients on windows will implement their ssh connection. I'm still trying to figure out how to access my repository from gitGui on a windows machine. It apparently does let me generate key files.

evo2, thanks for the clarification. as i just mentioned, i'm trying to sort out configuration issues in a windows machine. I'd also like to know how to set up eGit in Eclipse.

I'm not a pro with GIT and Windows setups, but you can check that link. It seems there are lots of HOWTO's over the Internet, so you won't have a problem finding the one appropriate for you

Best regards,
Konstantin

Making slow progress. Just have to sort out key generation details on linux/mac/windows. thanks for the response.

evo2: i tried keygen with -t rsa and -b 4096 and the server login failed.

i tried again with -b 2048 and it failed again.

i tried one more time with dsa and it worked just fine. weird.

interestingly, the key i generated using Git Gui on a windows machine appears to be rsa (the public key starts with ssh-rsa) and that key seems to work. not sure why the keygen fails on my Ubuntu 10.10 desktop for an ubuntu 11.04 server. weird.

You should check the logs (/var/log/auth.log) to find out why those RSA logins are failing. If you can't get enough information from that, you can run an instance of sshd in debug mode. It is probably best to run it on a different port, in parallel to the default sshd so that you don't accidentally lock yourself out of your server.

Eg.
And then try to connect
Cheers,

Evo2.

Or use -vvv to ssh to get a verbose output whether the client accesses the keys at all.