{"id":381,"date":"2019-06-13T18:31:40","date_gmt":"2019-06-13T16:31:40","guid":{"rendered":"http:\/\/hentati.org\/?p=381"},"modified":"2020-11-25T20:29:31","modified_gmt":"2020-11-25T19:29:31","slug":"ssh-with-public-key-authentication","status":"publish","type":"post","link":"https:\/\/hentati.org\/index.php\/2019\/06\/13\/ssh-with-public-key-authentication\/","title":{"rendered":"SSH WITH PUBLIC KEY AUTHENTICATION"},"content":{"rendered":"<h2><span style=\"color: #000000;\">Overview<\/span><\/h2>\n<p><span style=\"color: #000000;\">Public key authentication is a way of logging into an\u00a0SSH\/SFTP\u00a0account using a cryptographic key rather than a password.<\/span><\/p>\n<p><span style=\"color: #000000;\">If you use very strong SSH\/SFTP passwords, your accounts are already safe from brute force attacks. However, using public key authentication provides many benefits when working with multiple developers. For example, with SSH keys you can<\/span><\/p>\n<ul>\n<li><span style=\"color: #000000;\">allow multiple developers to log in as the same system user without having to share a single password between them;<\/span><\/li>\n<li><span style=\"color: #000000;\">revoke a single developer&#8217;s access without revoking access by other developers; and<\/span><\/li>\n<li><span style=\"color: #000000;\">make it easier for a single developer to log in to many accounts without needing to manage many different passwords.<\/span><\/li>\n<\/ul>\n<h2><span style=\"color: #000000;\">How Public Key Authentication Works<\/span><\/h2>\n<p><span style=\"color: #000000;\">Keys come in pairs of a public key and a private key. Each key pair is unique, and the two keys work together.<\/span><\/p>\n<p><span style=\"color: #000000;\">These two keys have a very special and beautiful mathematical property: if you have the private key, you can prove you have it without showing what it is. It&#8217;s like proving you know a password without having to show someone the password.<\/span><\/p>\n<p><span style=\"color: #000000;\">Public key authentication works like this:<\/span><\/p>\n<ol>\n<li><span style=\"color: #000000;\">Generate a key pair.<\/span><\/li>\n<li><span style=\"color: #000000;\">Give someone (or a server) the public key.<\/span><\/li>\n<li><span style=\"color: #000000;\">Later, anytime you want to authenticate, the person (or the server) asks you to prove you have the private key that corresponds to the public key.<\/span><\/li>\n<li><span style=\"color: #000000;\">You prove you have the private key.<\/span><\/li>\n<\/ol>\n<p><span style=\"color: #000000;\">You don&#8217;t have to do the math or implement the key exchange yourself. The SSH server and client programs take care of this for you.<\/span><\/p>\n<h2><span style=\"color: #000000;\">Generate an SSH Key Pair<\/span><\/h2>\n<p><span style=\"color: #000000;\">You should generate your key pair on your laptop, not on your server. All Mac and Linux systems include a command called\u00a0<tt>ssh-keygen<\/tt>\u00a0that will generate a new key pair.<\/span><\/p>\n<p><span style=\"color: #000000;\">If you&#8217;re using Windows, you can generate the keys on your server. Just remember to copy your keys to your laptop and delete your private key from the server after you&#8217;ve generated it.<\/span><\/p>\n<p><span style=\"color: #000000;\">To generate an SSH key pair, run the command\u00a0<tt>ssh-keygen<\/tt>.<\/span><\/p>\n<pre><span style=\"color: #000000;\">ssh-keygen<\/span><\/pre>\n<p><span style=\"color: #000000;\">It will look like this when you run it:<\/span><\/p>\n<pre><span style=\"color: #000000;\">laptop1:~ yourname$ ssh-keygen\r\nGenerating public\/private rsa key pair.<\/span><\/pre>\n<p><span style=\"color: #000000;\">You&#8217;ll be prompted to choose the location to store the keys. The default location is good unless you already have a key. Press\u00a0<b>Enter<\/b>\u00a0to choose the default location.<\/span><\/p>\n<pre><span style=\"color: #000000;\">Enter file in which to save the key (\/Users\/yourname\/.ssh\/id_rsa):<\/span><\/pre>\n<p><span style=\"color: #000000;\">Next, you&#8217;ll be asked to choose a password. Using a password means a password will be required to use the private key. It&#8217;s a good idea to use a password on your private key.<\/span><\/p>\n<pre><span style=\"color: #000000;\">Enter passphrase (empty for no passphrase):\r\nEnter same passphrase again:<\/span><\/pre>\n<p><span style=\"color: #000000;\">After you choose a password, your public and private keys will be generated. There will be two different files. The one named\u00a0<tt>id_rsa<\/tt>\u00a0is your private key. The one named\u00a0<tt>id_rsa.pub<\/tt>\u00a0is your public key.<\/span><\/p>\n<pre><span style=\"color: #000000;\">Your identification has been saved in \/Users\/yourname\/.ssh\/id_rsa.\r\nYour public key has been saved in \/Users\/yourname\/.ssh\/id_rsa.pub.<\/span><\/pre>\n<p><span style=\"color: #000000;\">You&#8217;ll also be shown a fingerprint and &#8220;visual fingerprint&#8221; of your key. You do not need to save these.<\/span><\/p>\n<pre><span style=\"color: #000000;\">The key fingerprint is:\r\nd7:21:c7:d6:b8:3a:29:29:11:ae:6f:79:bc:67:63:53 yourname@laptop1\r\nThe key's randomart image is:\r\n+--[ RSA 2048]----+\r\n|                 |\r\n|           . o   |\r\n|      .   . * .  |\r\n|     . .   = o   |\r\n|      o S . o    |\r\n|     . . o oE    |\r\n|    . .oo +.     |\r\n|     .o.o.*.     |\r\n|     ....= o     |\r\n+-----------------+<\/span><\/pre>\n<h2><span style=\"color: #000000;\">Configure an SSH\/SFTP User for Your Key<\/span><\/h2>\n<h3><span style=\"color: #000000;\">Method 1: Using\u00a0<tt>ssh-copy-id<\/tt><\/span><\/h3>\n<p><span style=\"color: #000000;\">Now that you have an SSH key pair, you&#8217;re ready to configure your app&#8217;s system user so you can SSH or SFTP in using your private key.<\/span><\/p>\n<p><span style=\"color: #000000;\">To copy your public key to your server, run the following command. Be sure to replace &#8220;x.x.x.x&#8221; with your server&#8217;s IP address and\u00a0<tt>SYSUSER<\/tt>\u00a0with the name of the the system user your app belongs to.<\/span><\/p>\n<pre><span style=\"color: #000000;\">ssh-copy-id SYSUSER@x.x.x.x<\/span><\/pre>\n<h3><span style=\"color: #000000;\">Method 2: Manual Configuration<\/span><\/h3>\n<p><span style=\"color: #000000;\">If you don&#8217;t have the\u00a0<tt>ssh-copy-id<\/tt>\u00a0command (for example, if you are using Windows), you can instead SSH in to your server and manually create the\u00a0<tt>.ssh\/authorized_keys<\/tt>\u00a0file so it contains your public key.<\/span><\/p>\n<p><span style=\"color: #000000;\">First, run the following commands to make create the file with the correct permissions.<\/span><\/p>\n<pre><span style=\"color: #000000;\">(umask 077 &amp;&amp; test -d ~\/.ssh || mkdir ~\/.ssh)\r\n(umask 077 &amp;&amp; touch ~\/.ssh\/authorized_keys)<\/span><\/pre>\n<p><span style=\"color: #000000;\">Next, edit the file\u00a0<tt>.ssh\/authorized_keys<\/tt>\u00a0using your preferred editor. Copy and paste your\u00a0<tt>id_rsa.pub<\/tt>\u00a0file into the file.<\/span><\/p>\n<h2><span style=\"color: #000000;\">Log In Using Your Private Key<\/span><\/h2>\n<p><span style=\"color: #000000;\">You can now SSH or SFTP into your server using your private key. From the command line, you can use:<\/span><\/p>\n<pre><span style=\"color: #000000;\">ssh SYSUSER@x.x.x.x<\/span><\/pre>\n<p><span style=\"color: #000000;\">If you didn&#8217;t create your key in the default location, you&#8217;ll need to specify the location:<\/span><\/p>\n<pre><span style=\"color: #000000;\">ssh -i ~\/.ssh\/custom_key_name SYSUSER@x.x.x.x<\/span><\/pre>\n<p><span style=\"color: #000000;\">If you&#8217;re using a Windows SSH client, such as PuTTy, look in the configuration settings to specify the path to your private key.<\/span><\/p>\n<h2><span style=\"color: #000000;\">Granting Access to Multiple Keys<\/span><\/h2>\n<p><span style=\"color: #000000;\">The\u00a0<tt>.ssh\/authorized_keys<\/tt>\u00a0file you created above uses a very simple format: it can contain many keys as long as you put one key on each line in the file.<\/span><\/p>\n<p><span style=\"color: #000000;\">If you have multiple keys (for example, one on each of your laptops) or multiple developers you need to grant access to, just follow the same instructions above using\u00a0<tt>ssh-copy-id<\/tt>\u00a0or manually editing the file to paste in additional keys, one on each line.<\/span><\/p>\n<p><span style=\"color: #000000;\">When you&#8217;re done, the\u00a0<tt>.ssh\/authorized_keys<\/tt>\u00a0file will look something like this (don&#8217;t copy this, use your own public keys):<\/span><\/p>\n<pre><span style=\"color: #000000;\">ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSkT3A1j89RT\/540ghIMHXIVwNlAEM3WtmqVG7YN\/wYwtsJ8iCszg4\/lXQsfLFxYmEVe8L9atgtMGCi5QdYPl4X\/c+5YxFfm88Yjfx+2xEgUdOr864eaI22yaNMQ0AlyilmK+PcSyxKP4dzkf6B5Nsw8lhfB5n9F5md6GHLLjOGuBbHYlesKJKnt2cMzzS90BdRk73qW6wJ+MCUWo+cyBFZVGOzrjJGEcHewOCbVs+IJWBFSi6w1enbKGc+RY9KrnzeDKWWqzYnNofiHGVFAuMxrmZOasqlTIKiC2UK3RmLxZicWiQmPnpnjJRo7pL0oYM9r\/sIWzD6i2S9szDy6aZ mike@laptop1\r\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzlL9Wo8ywEFXSvMJ8FYmxP6HHHMDTyYAWwM3AOtsc96DcYVQIJ5VsydZf5\/4NWuq55MqnzdnGB2IfjQvOrW4JEn0cI5UFTvAG4PkfYZb00Hbvwho8JsSAwChvWU6IuhgiiUBofKSMMifKg+pEJ0dLjks2GUcfxeBwbNnAgxsBvY6BCXRfezIddPlqyfWfnftqnafIFvuiRFB1DeeBr24kik\/550MaieQpJ848+MgIeVCjko4NPPLssJ\/1jhGEHOTlGJpWKGDqQK+QBaOQZh7JB7ehTK+pwIFHbUaeAkr66iVYJuC05iA7ot9FZX8XGkxgmhlnaFHNf0l8ynosanqt henry@laptop2<\/span><\/pre>\n<h2><span style=\"color: #000000;\">Additional Information<\/span><\/h2>\n<h3><span style=\"color: #000000;\">Retrieve Your Public Key from Your Private Key<\/span><\/h3>\n<p><span style=\"color: #000000;\">The following command will retrieve the public key from a private key:<\/span><\/p>\n<pre><span style=\"color: #000000;\">ssh-keygen -y -f \/path\/to\/your_private_key_file (eg. \/root\/.ssh\/id_rsa or ~\/.ssh\/custom_key_name)<\/span><\/pre>\n<p><span style=\"color: #000000;\">This can be useful, for example, if your server provider generated your SSH key for you and you were only able to download the private key portion of the key pair.<\/span><\/p>\n<p><span style=\"color: #000000;\">Note that you cannot retrieve the private key if you only have the public key.<\/span><\/p>\n<h3><span style=\"color: #000000;\">Correcting Permissions on the\u00a0<tt>.ssh<\/tt>\u00a0Directory<\/span><\/h3>\n<p><span style=\"color: #000000;\">The instructions in this article will create your server&#8217;s\u00a0<tt>.ssh<\/tt>\u00a0directory and\u00a0<tt>.ssh\/authorized_keys<\/tt>\u00a0file with the correct permissions. However, if you&#8217;ve created them yourself and need to fix permissions, you can run the following commands on your server while SSH&#8217;d in as your app&#8217;s system user.<\/span><\/p>\n<pre><span style=\"color: #000000;\">chmod 700 ~\/.ssh\r\nchmod 600 ~\/.ssh\/authorized_keys<\/span><\/pre>\n<div class=\"lastupdated\"><span style=\"color: #000000;\">\u00a0<\/span><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Overview Public key authentication is a way of logging into an\u00a0SSH\/SFTP\u00a0account using a cryptographic key rather than a password. If you use very strong SSH\/SFTP passwords, your accounts are already &#8230;<\/p>\n","protected":false},"author":1,"featured_media":384,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[8],"tags":[],"_links":{"self":[{"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/posts\/381"}],"collection":[{"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/comments?post=381"}],"version-history":[{"count":2,"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/posts\/381\/revisions"}],"predecessor-version":[{"id":440,"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/posts\/381\/revisions\/440"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/media\/384"}],"wp:attachment":[{"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/media?parent=381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/categories?post=381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hentati.org\/index.php\/wp-json\/wp\/v2\/tags?post=381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}