Home

Search this site:
 

Horshack’s
very
own site

 

This is Bavaria, Germany!
You will find links to Perl,
bootdisks for system administration,
a lot of Linux,
Windows administration
and some personal belongings.
ssh for users, creating keys, using ssh-agent

ssh for users, creating keys, using ssh-agent

This tells you how to deal with ssh-keys which make it even more secure to login into your shell account to Unix. In windows I use the free putty for Win32. Sysadmins who have to configure the serverside look here.

Creating a set of SSH-keys

If you want to use ssh the clever way you have to create ssh-keys. You will create two keys which belong together. You can image it like creating a keyhole and a key for that keyhole.

horshack@home:~/tmp$ ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/home/horshack/.ssh/id_dsa): 
Enter passphrase (empty for no passphrase): aPHRASEtoremind4$
Enter same passphrase again: aPHRASEtoremind4$
Your identification has been saved in /home/horshack/.ssh/id_dsa
Your public key has been saved in /home/horshack/.ssh/id_dsa.pub
The key fingerprint is:
c7:b4:f0:1c:d0:1d:a2:0e:8f:97:d9:17:3c:2a:3b:b3 horshack@home.rosi13.de

What are the files mentioned?

The file in your home-directory ~horshack/.ssh/id_dsa is your secret, private key. You must keep this file as sure as your passport in your wallet. You can secure this file with a passphrase. That means that you always have to tell the passphrase before you are able to use this file (there is a way to avoid tellling the passphrase again and again, it's called ssh-agent).
Only a file with this special name id_dsa in your home/.ssh-directory will be found automatically by the ssh-client-programs.

The file in your home-directory ~horshack/.ssh/id_dsa.pub is the keyhole. There is only one key on earth which is valid for this keyhole, it it your private key in the file id_dsa. The content of id_dsa.pub can be spread all over your computers. It is a loooooong line looking like this:

ssh-dss AAAAB3NzaC1kc3MAAACBANgJy/cMJimPI...6fQbu3ZeME= horshack@home.rosi13.de
The horshack@home.rosi13.de is only a comment for that keyhole-line. You can change it to what you like, for example richard for office use #3

How do I use my "keyhole"-file?

Create a file on your Linux-machine ~yourusername/.ssh/authorized_keys (the ssh-daemon on this machine looks at the place for your public key) and insert the line in the file id_dsa.pub. It must be _one_ line per key.

You can have more than one public-key-line in the file authorized_keys. You could use an office private-key _and_ your private private-key to log into this machine.

Using ssh-agent

Win32: use pagent.exe (where you finde putty).

When you are on your Linuxmachine with a shell you have to type your passphrase again and again like this:

horshack@home:~$ ssh horshack@foreigner.remote.de
Enter passphrase for key '/home/horshack/.ssh/id_dsa': YouRPassPhraSE
Last login: Sat Jan 14 19:07:54 2006 from p549453fd.dip.t-dialin.net
You can habe a program running passing the key to the remote computer. This program's name is ssh-agent. Use it like this:
horshack@home:~$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-ZDV23296/agent.23296; export SSH_AUTH_SOCK;
SSH_AGENT_PID=23297; export SSH_AGENT_PID;
echo Agent pid 23297;
Now copy the shown lines and paste them as commands. They set some environment-variables which lead to the current running ssh-agent.
horshack@home:~$ SSH_AUTH_SOCK=/tmp/ssh-ZDV23296/agent.23296; export SSH_AUTH_SOCK;
horshack@home:~$ SSH_AGENT_PID=23297; export SSH_AGENT_PID;
horshack@home:~$ echo Agent pid 23297;
Agent pid 23297
Now your agent is ready to get a private key from you:
horshack@home:~$ ssh-add
Enter passphrase for /home/horshack/.ssh/id_dsa: 
Identity added: /home/horshack/.ssh/id_dsa (/home/horshack/.ssh/id_dsa)
Now you don't have to type in your passphrase anymore. The ssh-agent program is doing this for you:
horshack@home:~$ ssh horshack@foreigner.remote.de
Last login: Sun Jan 15 16:43:00 2006 from p549453fd.dip.t-dialin.net
This is also valid for rsync -e ssh

Icons to use in Windows

Here are two nice icons for putty:

the colored icon, the grey icon.

Impressum