UsingSSH
Using SSH to connect to machines and to move data
Introduction
Using Key-Pairs
Creating the Keys
First, let's create a key-pair. Start by typing:
ssh-keygen
You will see a message like:
Generating public/private rsa key pair. Enter file in which to save the key (/home/gethin/.ssh/id_rsa):
The default filename suggested is fine, so accept it by hitting return.
Next you are prompted for a passphrase:
Enter passphrase (empty for no passphrase):
Think of a strong, yet memorable one and enter it. (One tip is to think of a phrase, saying, song lyric etc. For example "One small step for man, one giant leap for mankind." Then take the first letters from each word, perhaps substituting digits for letters, to create the passphrase, "Oss4mogl4m.") You will be prompted for your passphrase twice:
Enter same passphrase again:
When the key-pair creation is completed, you will get some lines of text as confirmation, such as:
Your identification has been saved in /home/gethin/.ssh/id_rsa. Your public key has been saved in /home/gethin/.ssh/id_rsa.pub. The key fingerprint is: 37:7a:b3:81:e2:0e:fa:5e:b2:df:84:a5:fb:f9:e6:f7
Distributing Your Public Key
Now that you have your key-pair, you can copy your public key to any machine that you would like to connect to from the machine that you are currently logged into. When the keys are setup correctly, you will be able to connect without typing your password. Hurrah for the convenience!
The first step is to ensure that the permissions on your files are correct. The following commands will take care of this:
cd ~/.ssh chmod 600 * cd ~ chmod 700 .ssh
Now, let's copy your public key to the remote host of interest. In this case, I want to be able to login to a machine called brian, from one called dylan:
scp ~/.ssh/id_rsa.pub brian:~/.ssh/from-host.pub
(I'm assuming here that your username matches on the two machines. If not, you can prepend your username to the destination string, i.e. <username>@brian:~/.ssh/from-dylan.pub.)
Now, login to the remote host in the normal way:
ssh brian
where you will be prompted for your password, as per usual:
gethin@brian's password:
The following commands will:
- ensure that your file permissions are correct on the remote host
- add your public key to the list of authorized keys
- exit from the remote host
chmod 700 ~/.ssh cd ~/.ssh chmod 600 * cat from-host.pub >> authorized_keys exit
Now, when you connect to your remote host:
ssh brian
you will be prompted for your passphrase rather than your password:
Enter passphrase for key '/home/gethin/.ssh/id_rsa':
Some progress! you may say, and at first blush you are (almost) right, but hang on a moment and we will see how we can connect to remote hosts with keys set up this way, only having to type your passphrase once.
Since you're currently logged in to your remote host, we may as well do a little tidying:
rm ~.ssh/from-host.pub exit
Using ssh-agent
Enter ssh-agent and the potential for passwordless logins.
A quick way to try this out is to type:
ssh-agent bash
This will start a bash shell as the child of the ssh-agent process. (You may like to substitute bash with your shell of choice.)
Now type:
ssh-add
and you will be prompted for your passphrase:
Enter passphrase for /home/gethin/.ssh/id_rsa:
if you type correctly, you will get a confirmation:
Identity added: /home/gethin/.ssh/id_rsa (/home/gethin/.ssh/id_rsa)
and now when you connect to your remote host, you won't need to enter a thing! You can exit and connect again. Still no need for a password. You can start an xterm and connect from there. No password required. As you can see, all child processes can use the cached passphrase added to your agent.
Automating the Agent
We can make the process of starting an agent and adding your keys more automated, and hence convenient than the steps above. First of all, create a file called ~/.ssh/setup containing the following text:
#!/bin/sh # Checks for current ssh agent, otherwise starts one. # For bash and ksh users: # # include the following in your ~/.bashrc or ~/.kshrc or ~/.profile # # . $HOME/.ssh/setup # # For csh and tcsh users: # # include the following in your ~/.cshrc or ~/.tcshrc # # source $HOME/.ssh/setup # SSH_ENV="$HOME/.ssh/environment" function start_agent { echo "Initialising new SSH agent..." /usr/bin/ssh-agent | sed 's/^echo/#echo/' > "${SSH_ENV}" echo succeeded chmod 600 "${SSH_ENV}" . "${SSH_ENV}" > /dev/null /usr/bin/ssh-add; } # Source SSH settings, if applicable if [ -f "${SSH_ENV}" ]; then . "${SSH_ENV}" > /dev/null ps -ef | grep ${SSH_AGENT_PID} | grep ssh-agent$ > /dev/null || { start_agent; } else start_agent; fi
For BASH
Add:
. $HOME/.ssh/setup
to your ~/.bashrc, and:
kill $SSH_AGENT_PID
to your ~/.bash_logout
For KSH
. $HOME/.ssh/setup trap ". ~/.logout" EXIT
to your .kshrc, and:
kill $SSH_AGENT_PID
to your ~/.logout
Now you will be prompted for your passphrase only once, at login and all other connections will be passwordless.