My personal notes on all things technical and factual....

Clayton's Tech Bits

Search this site:

Custom Search

Fri, 27 Jan 2012

/Admin/SSH-SSL: Passwordless Authentication with SSH

How to use SSH keys to login to your server without giving a password -- perhaps contra-inuitively, this kind of passwordless login is usually more, not less, secure then a password login. (Not to mention convenient and time-efficient....)

Say we want to login to server.com from our desktop without a password. The rdiff-backup wiki provides a somewhat obtuse and hard-to-read article[1] on the subject. For the basics, I prefer to start with this article[2].

On your desktop, run:

ssh-keygen -b 4096 -t rsa -f /home/username/.ssh/id_rsa
Do not enter a pass-phrase!! Leave it blank

(Note: we are creating a 4096 bit key here as recommended by nearlyfreespeech.net[3]. It is possible that some situations will require a 1024 bit key, and this key will not be useable in that situation. It is possible to have multiple keys, which may be invoked by the "ssh -i" option, for instance.)

Now copy the public key "id_rsa.pub" to root@server.com:

scp /home/username/.ssh/id_rsa.pub root@server.com:

Go to server.com and append the new key to the authorized_keys:

ssh server.com
cd /root/.ssh/
cat ../id_rsa.pub >> authorized_keys

Restrict access to these keys on both your desktop and your root@server:

chmod -R go-rwx ~/.ssh

Test to verify you are not prompted for a password. In a terminal on your desktop, try a verbose ssh to server.com:

ssh -v root@server.com

If there are problems and you are prompted for a password (you should not be) the -v output should give you some clues.

In some situations, one can make SSH key logins even more secure. For instance, on server.com, add some security directives to a particular key in /root/.ssh/authorized_keys by pre-pending the following:

command="rdiff-backup --server --restrict-read-only/",no-port-forwarding,no-X11-forwarding,no-pty

ie. in /root/.ssh/authorized_keys the key in qestion now contains the following, ALL ON ONE LINE, and note the single space before "ssh-rsa":

command="rdiff-backup --server --restrict-read-only /",no-port-forwarding,no-X11-forwarding,no-pty ssh-rsa AA ... uqdswe= user@desktop

"no-pty" explicitly forbids terminal priveleges. "command" here restricts the session to running one and only one command: "rdiff-backup --server --restrict-read-only".

Now if you try to ssh to root@server.com from a terminal, your terminal will just lock-up and stop responding. If you really do want to allow this (a terminal ssh to root@server.com without a password) just remove the "command" and "no-pty" directives from the server.com /root/.ssh/authorized_keys file.

Note that this will only work from the account "username" on your desktop machine where you have generated a /home/username/.ssh/id_rsa file and then passed the public key to server.com. Trying to ssh from any other desktop account to root@server.com will result in a password prompt.

[1] http://wiki.rdiff-backup.org/wiki/index.php/UnattendedRdiff
[2] http://linuxgazette.net/104/odonovan.html
[3] https://members.nearlyfreespeech.net/ckoen/support/faq?q=SSHKeys#SSHKeys

posted at: 00:51 | path: /Admin/SSH-SSL | permanent link to this entry

Home

Contact

Resumé / C.V.

Links

Categories:

Archives:

Subscribe XML RSS Feed

Fri, 27 Jan 2012