Ssh, passwordless authentication - Revision history

Jimbo: SSH: Passwordless authentication moved to Ssh, passwordless authentication

2010-01-12T23:45:11Z

SSH: Passwordless authentication moved to Ssh, passwordless authentication

Jimbo: Reverted edits by 75.21.164.212 (Talk); changed back to last version by Jimbo

2009-07-02T17:58:22Z

Reverted edits by 75.21.164.212 (Talk); changed back to last version by Jimbo

75.21.164.212 at 17:28, 2 July 2009

2009-07-02T17:28:41Z

Jimbo: Reverted edits by 61.47.7.195 (Talk); changed back to last version by Jimbo

2007-11-15T07:07:24Z

Reverted edits by 61.47.7.195 (Talk); changed back to last version by Jimbo

83.135.20.151: deleted spam!

2007-04-28T09:09:55Z

deleted spam!

76.21.105.167 at 23:06, 20 March 2007

2007-03-20T23:06:45Z

24.202.77.103: spelling

2006-11-01T18:24:25Z

spelling

85.28.87.227 at 14:33, 13 August 2006

2006-08-13T14:33:05Z

Jimbo at 16:14, 21 January 2006

2006-01-21T16:14:26Z

195.5.32.230 at 08:23, 21 January 2006

2006-01-21T08:23:04Z

@@ Line 1: / Line 1: @@
-On client machine
+Sometimes, you need to be able to SSH into a remote machine for scripted maintenance purposes and not get challenged with a password.  To do this, you need to set up key-based authentication between the user account you'll be using on your local computer, and the user account you'll be logging into on the remote computer.  Here's a quick and dirty how-to.
-  cd ~/.ssh
-  ssh-keygen -t rsa
-Transfer <tt>id_rsa.pub</tt> to <tt>server:~/.ssh</tt>
+Creating a public/private keyset with [[ssh-keygen]] on the computer and under the user account you want to log in FROM:
-On server machine
+ ph34r# '''mkdir ~/.ssh'''
-  cd ~/.ssh
+  ph34r# '''chmod 700 ~/.ssh'''
-  cat id_rsa.pub >> authorized_keys
+ ph34r# '''cd ~/.ssh'''
-  rm id_rsa.pub
+  ph34r# '''ssh-keygen -t rsa'''

@@ Line 1: / Line 1: @@
-Sometimes, you need to be able to SSH into a remote machine for scripted maintenance purposes and not get challenged with a password.  To do this, you need to set up key-based authentication between the user account you'll be using on your local computer, and the user account you'll be logging into on the remote computer.  Here's a quick and dirty how-to.
+On client machine
-Creating a public/private keyset with [[ssh-keygen]] on the computer and under the user account you want to log in FROM:
+Transfer <tt>id_rsa.pub</tt> to <tt>server:~/.ssh</tt>
- ph34r# '''mkdir ~/.ssh'''
+On server machine
-  ph34r# '''chmod 700 ~/.ssh'''
+  cd ~/.ssh
- ph34r# '''cd ~/.ssh'''
+  cat id_rsa.pub >> authorized_keys
-  ph34r# '''ssh-keygen -t rsa'''
+  rm id_rsa.pub
- Generating public/private rsa key pair.
- Enter file in which to save the key ("your_local_home"/.ssh/id_rsa):
- Enter passphrase (empty for no passphrase):
- Enter same passphrase again:
- Your identification has been saved in id_rsa.
- Your public key has been saved in id_rsa.pub.
- The key fingerprint is:
-:5a:e7:77:ad:2c:0b:8e:f3:97:f8:20:53:79:69:55 root@ph34r
-−
-Getting the public half of the key to the REMOTE computer and user account you want to log in TO:
-−
- ph34r# '''scp ~/.ssh/id_rsa.pub jimbo@l0ath1ng.tehinterweb.net:/home/jimbo/id_rsa.ph34r.pub'''
- ph34r# '''ssh jimbo@l0ath1ng.tehinterweb.net'''
- Password:
- % mkdir .ssh
- % chmod 700 .ssh
- % cat id_rsa.ph34r.pub >> .ssh/authorized_keys
-  % chmod 644 .ssh/authorized_keys
-−
-Checking to make sure it worked:
-−
- % '''exit'''
- ph34r# '''ssh jimbo@l0ath1ng.tehinterweb.net'''
-−
-−
-Bingo.
-−
-From here on out, whenever logged in as root on the computer ph34r, I will be able to SSH into my account jimbo on the machine l0ath1ng without being presented with a password challenge (assuming I did NOT enter a passphrase when I generated the RSA key in the first step).  Note that I will not be able to use this key to bypass the password when logging into jimbo@l0ath1ng from any account OTHER than root@ph34r - if I were try it from jimbo@ph34r, I would still need a password.
-−
-If I wanted to log in from or to any other user accounts, the steps would be the same, just do them as the appropriate user.
-−
-NOTE: it is highly HIGHLY recommended that you only set up passwordless authentication to extremely neutered accounts on the target machine; perhaps an account with absolutely no privileges at all beyond [[sudo]] permission (if necessary) to run a single script which the account in question DOES NOT have write permission on.  This limits the damage a potential rogue user who compromises the computer on the other end could cause.
-−
-One way to use passwordless authentication in a safe way, is to replace the default shell (sh, csh, bash...) by a more restricted shell. The scponly is such a shell. Scponly only allows a very restricted set of commands. It can also do a chroot, thus greatly limiting the access to the system. Scponly is mainly used to let people access a remote account with commands like "scp" or "rsync" over "ssh"to do secure remote backups.
-−
-−
-----
-−
-−
-You may also be interested in these articles at IBM's "developerworks" library:
-−
-[http://www-128.ibm.com/developerworks/linux/library/l-keyc.html Understanding RSA/DSA authentication, Part 1]<br>
-[http://www-128.ibm.com/developerworks/library/l-keyc2/ OpenSSH key management, Part 2]<br>
-[http://www-128.ibm.com/developerworks/linux/library/l-keyc3/ OpenSSH key management, Part 3]
-−
-−
-----
-−
-−
-[[Category:Common Tasks]] [[Category:FreeBSD for Servers]][[Category:Configuring FreeBSD]]

← Older revision		Revision as of 09:09, 28 April 2007
Line 17:		Line 17:

	Getting the public half of the key to the REMOTE computer and user account you want to log in TO:		Getting the public half of the key to the REMOTE computer and user account you want to log in TO:
−
−	~~you really should use cat and not just overwrite stuff.~~

	ph34r# '''scp ~/.ssh/id_rsa.pub jimbo@l0ath1ng.tehinterweb.net:/home/jimbo/id_rsa.ph34r.pub'''		ph34r# '''scp ~/.ssh/id_rsa.pub jimbo@l0ath1ng.tehinterweb.net:/home/jimbo/id_rsa.ph34r.pub'''

← Older revision		Revision as of 23:06, 20 March 2007
Line 17:		Line 17:

	Getting the public half of the key to the REMOTE computer and user account you want to log in TO:		Getting the public half of the key to the REMOTE computer and user account you want to log in TO:
		+
		+	you really should use cat and not just overwrite stuff.

	ph34r# '''scp ~/.ssh/id_rsa.pub jimbo@l0ath1ng.tehinterweb.net:/home/jimbo/id_rsa.ph34r.pub'''		ph34r# '''scp ~/.ssh/id_rsa.pub jimbo@l0ath1ng.tehinterweb.net:/home/jimbo/id_rsa.ph34r.pub'''

← Older revision		Revision as of 18:24, 1 November 2006
Line 40:		Line 40:
	NOTE: it is highly HIGHLY recommended that you only set up passwordless authentication to extremely neutered accounts on the target machine; perhaps an account with absolutely no privileges at all beyond [[sudo]] permission (if necessary) to run a single script which the account in question DOES NOT have write permission on. This limits the damage a potential rogue user who compromises the computer on the other end could cause.		NOTE: it is highly HIGHLY recommended that you only set up passwordless authentication to extremely neutered accounts on the target machine; perhaps an account with absolutely no privileges at all beyond [[sudo]] permission (if necessary) to run a single script which the account in question DOES NOT have write permission on. This limits the damage a potential rogue user who compromises the computer on the other end could cause.

−	One way to use passwordless authentication is a safe way, is to replace the default shell (sh, csh, bash...) by a more restricted shell. The scponly is such a shell. Scponly only allows a very restricted set of commands. It can also do a chroot, thus greatly limiting the access to the system. Scponly is mainly used to let people access a remote account with commands like "scp" or "rsync" over "ssh"to do secure remote backups.	+	One way to use passwordless authentication in a safe way, is to replace the default shell (sh, csh, bash...) by a more restricted shell. The scponly is such a shell. Scponly only allows a very restricted set of commands. It can also do a chroot, thus greatly limiting the access to the system. Scponly is mainly used to let people access a remote account with commands like "scp" or "rsync" over "ssh"to do secure remote backups.

← Older revision		Revision as of 14:33, 13 August 2006
Line 39:		Line 39:

	NOTE: it is highly HIGHLY recommended that you only set up passwordless authentication to extremely neutered accounts on the target machine; perhaps an account with absolutely no privileges at all beyond [[sudo]] permission (if necessary) to run a single script which the account in question DOES NOT have write permission on. This limits the damage a potential rogue user who compromises the computer on the other end could cause.		NOTE: it is highly HIGHLY recommended that you only set up passwordless authentication to extremely neutered accounts on the target machine; perhaps an account with absolutely no privileges at all beyond [[sudo]] permission (if necessary) to run a single script which the account in question DOES NOT have write permission on. This limits the damage a potential rogue user who compromises the computer on the other end could cause.
		+
		+	One way to use passwordless authentication is a safe way, is to replace the default shell (sh, csh, bash...) by a more restricted shell. The scponly is such a shell. Scponly only allows a very restricted set of commands. It can also do a chroot, thus greatly limiting the access to the system. Scponly is mainly used to let people access a remote account with commands like "scp" or "rsync" over "ssh"to do secure remote backups.

← Older revision		Revision as of 08:23, 21 January 2006
Line 39:		Line 39:

	NOTE: it is highly HIGHLY recommended that you only set up passwordless authentication to extremely neutered accounts on the target machine; perhaps an account with absolutely no privileges at all beyond [[sudo]] permission (if necessary) to run a single script which the account in question DOES NOT have write permission on. This limits the damage a potential rogue user who compromises the computer on the other end could cause.		NOTE: it is highly HIGHLY recommended that you only set up passwordless authentication to extremely neutered accounts on the target machine; perhaps an account with absolutely no privileges at all beyond [[sudo]] permission (if necessary) to run a single script which the account in question DOES NOT have write permission on. This limits the damage a potential rogue user who compromises the computer on the other end could cause.
		+
		+	'''There are great stories, on how to securely use passwordless ssh authentication using password protected private key.'''<br>
		+	[http://www-128.ibm.com/developerworks/linux/library/l-keyc.html Understanding RSA/DSA authentication, Part 1]<br>
		+	[http://www-128.ibm.com/developerworks/library/l-keyc2/ OpenSSH key management, Part 2]<br>
		+	[http://www-128.ibm.com/developerworks/linux/library/l-keyc3/ OpenSSH key management, Part 3]<br>

	[[Category:Common Tasks]] [[Category:FreeBSD for Servers]][[Category:Configuring FreeBSD]]		[[Category:Common Tasks]] [[Category:FreeBSD for Servers]][[Category:Configuring FreeBSD]]