Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I KNOW how to setup a new ssh key pair with github.

If someone gave me a private key and told me to connect to a server via ssh on a mac, how do I set this up?

NOTE: I can't change the server settings.

share|improve this question

migrated from stackoverflow.com Oct 12 '11 at 11:17

This question came from our site for professional and enthusiast programmers.

2 Answers 2

I found your question while looking for a way to manage Amazon EC2 keys. Like you, I already had a key for github.


What I did was duplicate the existing id_rsa file.

cp ~/.ssh/id_rsa ~/.ssh/id_rsa_amazonhost.pem

And then replace the contents of this new file (id_rsa_amazonhost.pem) via cut/paste with the private key provided by Amazon.

Then I added an entry to ~/.ssh/config (replace my-hostname and my-username as appropriate).

Host my-hostname.example.com
    IdentityFile  ~/.ssh/id_rsa_amazonhost.pem
    User my-username    

This allowed me to ssh my-hostname as desired.


For a one-time connection, you can skip the ~/.ssh/config file and simply run

ssh -i id_rsa_amazonhost.pem my-username@my-hostname

share|improve this answer

I assume the standard OpenSSH is available on your Mac; if you're using a pretty GUI program, then this might not work. I also assume you've been given an OpenSSH-standard key. (The commercial ssh.com keys might be formatted differently; at least they were a decade ago, when I last used a provider that still used the commercial SSH.)

Perhaps you already have a private key; check ls -l ~/.ssh/id_* to see if you already have a private key installed. If you do (and you want to keep that key) then you'll have more work to do.

If you don't already have a private key, take a look at the first line of the file. It'll look something like this:

-----BEGIN RSA PRIVATE KEY-----

If it says RSA, like mine, then store the file into ~/.ssh/id_rsa. If it says DSA, store it into ~/.ssh/id_dsa.

If the ~/.ssh directory does not exist yet, create it:

mkdir ~/.ssh
chmod 700 ~/.ssh

The chmod 700 is important -- ssh is picky about permissions: if even group write is available, you may have problems.

I don't know the easiest way to store the file. If you have a standalone file (email attachment, web site download, etc.), you can simply move the file into place:

mv Path/to/the/file ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa

The chmod 600 is important -- ssh is picky about permissions: if even group read is available, you may have problems. I'm not kidding -- I've spent too much of my life debugging connection problems that came down to over-strict permissions checking by ssh. You could make it 400 and prevent yourself from mistakenly overwriting it, but mine is 600 with no ill consequences.

If you've got the file copy-and-pasted into an email text or web page text, you'll need to use a text editor of some sort to save the file, via copy-and-paste of the text itself. (Don't use Word. BBEdit or TextMate or .. whatever Apple calls their plain text editor .. would work.)

Now test it:

ssh hostname

e.g.:

$ ssh haig
Enter passphrase for key '/home/sarnold/.ssh/id_rsa': 

If you need to give a username too:

ssh username@hostname

The important piece is the for key -- if it just asks for a password, it is probably a password for the remote endpoint, and that won't work. If it asks for the passphrase for the key, then you're running.


If you already have a private key you wish to keep using, store the file into something else; e.g. ~/.ssh/id_rsa_for_mithra, and then add a new Host entry into a ~/.ssh/config configuration file:

host mithra
    IdentityFile ~/.ssh/id_rsa_for_mithra

Here, I've assumed the hostname is mithra. Use whatever name or IP address you've been given.


The ~/.ssh/config file can also be used to specify a per-host username if you want to avoid giving it on the command line all the time.

And the final note: most ssh users use the ssh-agent to store a decrypted version of their private key rather than re-type the passphrase to unlock it all the time. I understand an ssh agent is integrated into OS X these days -- it would be worth investigating how to use it. Perhaps it is as simple as running ssh-add first. (I like ssh-add -t 3600, so the key works for an hour before the decrypted version is thrown away. That helps protect the key material somewhat if I walk away from my workstation without requiring my to run ssh-add -D when I leave.)

share|improve this answer
1  
One handy way to always create the .ssh directory with the "right" permissions is to just run ssh localhost as that user (it'll fail to log in, but in the process of failing, it'll create the .ssh directory). –  Amber Oct 12 '11 at 18:15
    
Thanks for the detailed post. Unfortunately, it didn't help. I've setup ssh in the past (for github) and it's usually two lines of instructions and I've had no issues. A quick search on this "ssh private key" will generate a million results on google. –  pritam Oct 13 '11 at 14:59
    
@amber: Oh! That makes sense, I should have known the ssh team would have been kind enough to create the missing directory. Thanks. –  sarnold Oct 13 '11 at 21:48
    
@pritam: where are you stuck? I perhaps gave a too-comprehensive answer since there were many unknown variables. Do you already have a private key in your ~/.ssh/id_rsa or ~/.ssh/id_dsa? Will you use the same username on both hosts or do you need to use a different username on the other host? Did you successfully store the private key into a file? With what permissions? Do you get any error messages when you try to ssh to the remote host? Do you get any error messages when you try to add the key to your ssh-agent? –  sarnold Oct 13 '11 at 21:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.