Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been trying to follow this tutorial: This Tutorial, but have come stuck at the point of logging in via public keys (without passsword prompt). I'm fairly new to unix comand line.

My scenario is, I'm running a php script (ssh2) and running the below command after successfully connecting via ssh.

ssh -f -L 3307:127.0.0.1:3306 someuser@remote.server.com sleep 60 >> logfile

Below is the part of the tutorial I can't figure out. I've tried doing ssh-keygen and storing the public/private keys in my /home/someuser/.ssh/authorized_keys and authorized_keys.pub files. But to no avail :(, Thanks for any help.

Avoiding a password prompt: Normally, after issuing a command like the one above, you will receive a password prompt to validate the user logging into the remote machine. Again, this is bad for automation, since it's never a good idea to have an application interacting with a command line prompt (or storing plain-text passwords). Public key encryption comes to the rescue again in this case. SSH won't prompt for a password if the public certificate of remote user is stored in the ~/.ssh/authorized_keys file of the remote user account being logged into. We simply append our public key to this file and password prompts are no longer an issue.

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

No, there is no ~/.ssh/authorized_keys.pub file and don't put your private key in authorized_keys! Your private key should be only in the generated file and put nowhere else (a backup perhaps only).

What you have to do is, first on your local host from where you will start the ssh command, create the key using ssh-keygen, with or without password as you wish, but keep in mind that anyone that gets this private key without password would be able to login also. So keep it private.

Then on the remote host you want to login into with this key, put in ~/.ssh/authorized_keys the public part of the generated key id_dsa.pub (or the name you got).

This would do it. Keep in mind that, since ssh enforces security, file permissions are VERY important. Read the section "FILES" in

man ssh
share|improve this answer
    
It's worth noting that using a passphrase breaks automation, which is the entire purpose of this exercise for this particular person. –  Ernie Feb 14 '11 at 18:33
    
Okay... this is where I'm a little unclear. I'm using WAMP server on a PC, and logging to ssh via php_ssh2, so how can I create the key using ssh-keygen on this local host? –  Emmanuel Feb 14 '11 at 18:33
    
You want to login using php_ssh2 which is running on a Windows WAMP server onto another PC running some Unix/Linux OS? Or are you trying to login into the same Windows PC? It doesn't matter where you create your key, what you have to find out is where php_ssh2 will search for it (HOME user directory under windows?) and put the generated key there, at least the private part. Then put the public part on the authorized_keys file on the destination computer where you (or php_ssh2) want to login into, if it's the same PC, then it will be the same directory where you put the private key! –  rems Feb 14 '11 at 18:44
    
I want to login via php_ssh2 which is running on Windows WAMP server onto my remote linux VPS. Oh, I think I'm getting it now. So it doesn't matter where you create the key, I just have to have put the public part one one server and the private part on another. Okay... I'm giving it a go –  Emmanuel Feb 14 '11 at 18:52
    
Yes, the private part is always ONLY on the client, the computer that initiates the connection, either by issuing an ssh command or php_sshd2 from a script, YOUR computer, the one you trust. The public part is in the remote host, the computer you log into, the one running the sshd server you connect to. This could be an untrusted server, since the public part of the key only allows to log into that computer, or start remote commands, but not the other way. Someone getting your public key won't be able to log into your computer by any means. –  rems Feb 14 '11 at 19:16
show 3 more comments

I know what you mean. I think that the instructions at openssh.org are about as clear as mud. The simple version is like this:

Start with the user on the client machine that will be ssh'ing to remote.server.com. Run ssh-keygen there. When it asks you for a passphrase, just press enter.

Copy the file .ssh/id_rsa.pub (or id_dsa.pub, depending on your encryption type) to remote.server.com, then append the contents of this file to ~someuser/.ssh/authorized_keys. You can also edit this file and then paste the contents of id_rsa.pub to the end of authorized_keys.

Test this by sshing from the client machine (as the user you ran ssh_keygen as) to someuser@remote.server.com. It shouldn't ask you for a password. If it does, then there may be some permissions issue (permissions should be 600 on both ~someuser/.ssh as well as ~someuser/.ssh/authorized_keys) or something else that will be caught by the logs on remote.server.com. You can also run the ssh server on remote.server.com in debug mode (sshd -d) to see what it's doing.

WARNING!

Since you are using no passphrase on this key, make sure that you do not share this public key with anyone else. Should you get errors about a host key fingerprint or a "man in the middle" attack after this initial setup, REFUSE TO CONNECT TO THIS SERVER! Any automated task will fail on such an error and the public key will not be sent. The only legitimate case in which you will want to painstakingly work around such an error (the openssh client will give you directions about how to do this) is when the key fingerprint on the server changes, usually due to an upgrade of SSH on that server. If you are not the administrator of the remote server, contact that person directly and ask if anything has changed on their server before changing your host key database.

share|improve this answer
    
Sounds good! But I'm using WAMP server on a PC, and logging to ssh via php_ssh2, so how can I generate key with this setup? –  Emmanuel Feb 14 '11 at 18:37
    
You will create the keys as normal, and use the functions of php_ssh2 to specific you want to use a key file to login. The following page gives an example of doing this: php.net/manual/en/function.ssh2-auth-pubkey-file.php –  mcmeel Feb 14 '11 at 18:44
    
Okay... I'll give this a go –  Emmanuel Feb 14 '11 at 18:53
add comment

Surprised ssh-copy-id was not mentioned - it makes it simple.

ssh-copy-id username@remotehost.com
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.