Tag Info

Hot answers tagged

236

For Git Bash If you are running msysgit (I am assuming you are) and are looking to run Git Bash (I recommend it over TortoiseGit, but I lean to the CLI more than GUI now), you need to figure out what your home directory is for Git Bash by starting it then type pwd (On Win7, it will be something like C:\Users\phsr I think). While you're in git bash, you ...


125

Use the -y option to ssh-keygen: ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub From the 'man ssh-keygen' -y This option will read a private OpenSSH format file and print an OpenSSH public key to stdout. Specify the private key with the -f option, yours might be dsa instead of rsa. The name of your private key probably contains ...


51

Using the built-in SSH client shipped with Git for windows, you need to setup the HOME environment variable so that the Git SSH client can find the key. For example, on a Windows Vista installation, this would be done by issuing setx HOME c:\Users\admin\ on the command line. Made my day and fixed the issue with Git provided that your private key is not ...


33

Thinking more deeply about the authentication process, what needs to be kept secret? Amazon knows the public half of the key, and anybody can know the public half. The public half of the keypair, when matched with the private half, denotes that the private half was used to authenticate. You private key that is provided to you when Amazon generates a keypair ...


30

You can specify the Key Location for Tortoisegit the following way: Open an Explorer Window. Open the Contextmenu and Navigate TortoiseGit > Settings In the now opened window Navigate to Git > Remote Set the Path to your Putty Key in the corresponding Input Box. Screen shoot below:


25

I worked at a company where the security of the CA key was critical to the continued success of the business. To this end the key was encrypted using a custom protocol that required at least 2 people to be present with physical tokens plugged into terminals to decrypt it(there were at least 5 of these tokens, any 2 combined would work). The terminals were ...


24

None of the answers above worked for me. Here was what worked for me in the end. It is actually fairly simple, if you know what to type. It doesn't need putty. open a git bash prompt type 'ssh-keygen' accept the default location choose a blank passphrase (so just press 'enter' to all questions') now copy to your server, eg: scp ~/.ssh/id_rsa.pub ...


17

Amazon provides key generation services because some operating systems (cough, Windows, cough) may not make it easy to generate the SSH keypairs. With SSH (and SFTP), the public key is installed in the user's authorized_keys file as the EC2 instance starts up. The private key is held only by the user and is presented to authenticate against the server. ...


16

One big gain is to keep the private CA key on a dedicated computer completely cut off from the network. You would then sign, and possibly also generate, new certificates on this machine, and then use an physical media to transfer the new certificates off the CA machine. Such as setup would of course also include considerations regarding the physical ...


15

If you're using msysgit with the OpenSSH tools, you need to either create ~/.ssh/id_rsa, or create a git config in ~/.ssh/config which points to your key. Here's an example of a Git config for bitbucket that will use the correct username, and a key other than the default key (in case you maintain one key for SSH connections, and another for git accounts). ...


14

I have upvoted the other two answers, and commented thereon, because I think they're both excellent. If you decide to go for both of them, and that might well be appropriate, I strongly advise care in the initial generation of the key, since the best time to compromise a key is not in use (where many standard, repeatable precautions can be applied) but at ...


12

Yes. The only thing that matters for asymmetric encryption are the keys themselves. Alice encrypts something using Bob's public key, and only Bob with possession of his private key may decrypt the transmission and retrieve the original plaintext from Alice. Since private keys are very sensitive, it is not a good idea to leave them laying around (in your ...


11

Presently the only way of "recovering" the Private key from the Public key is by exhaustive search (brute force). The system was specifically designed this way so that you could issue your public key to anyone without worrying about them being able to figure out your private key. Edit: Warning! Simplified explanation ahead! Assuming you had RSA keys (the ...


11

AFAIK, there is no way to bypass the keyfile permission check with ssh or ssh-add (and you can't trick it with named pipe or such). Besides, you do not actually want to trick ssh, but just to be able to use your key files. Indeed, TrueCrypt volume is supposed to keep your data private, so mounting the volumes as world-readable (default behaviour of ...


10

There's also the whole "Dropbox can read your stuff" problem. What you should do is encrypt everything before putting it into Dropbox. Use something like KeePass as a secrets vault. Put a good password on it. KeePass will encrypt locally, before putting your stuff into Dropbox. You will then use KeePass on other computers to access those secrets. Take ...


9

You can override this with a personal config file and point to your keyfile; vi ~/.ssh/config And then you can append the following; Host vps1 IdentityFile ~/.ssh/privateKey Tip: I usually have to following set before any host declaration, it will try your default key first, then it will look in the folder ~/.ssh/$hostname/$userid and finally in ...


9

The classic reference for this is this FAQ in the online Apache docs. In that document, an md5 of the modulus is used because As the public exponent is usually 65537 and it's difficult to visually check that the long modulus numbers are the same, you can use the following approach This gives: $ openssl rsa -noout -modulus -in key.pem.decrypted | ...


8

The simple answer is: You don't. SSH keys and GnuPG (actually, OpenPGP) keys are completely different, even though both protocols can use RSA key pairs. And besides, why would you want to do it? Even if you were to use the same key material to make up your PGP key, you'd still need to distribute your key as a PGP key. You likely haven't been distributing ...


7

Depending on how serious you are, you should consider using FIPS 140-2 (http://en.wikipedia.org/wiki/FIPS_140#Security_levels) hardware to store CA keys and back-ups of those keys. You should have one root CA and one intermediate CA so you can keep your root CA offline and physically secured. The root is only needed to renew or sign new intermediate CAs, ...


7

In my experience the two most common key based auth errors are Inappropriately broad permissions on the $HOME/.ssh directory An error in copying the public key to the remote system File Permissions OpenSSH does a lot in an attempt to protect you from yourself. The most user impacting way this happens is by enforcing hard restrictions on who has access ...


7

Following James Sneeringer's solution, you might just want to set an ssh_config along the lines of: Host *.mycompany.com IdentityFile .ssh/id_dsa_mycompany_main Host *.mycustomer.com IdentityFile .ssh/id_dsa_mycustomer Host * RSAAuthentication no #this should be up top, avoid ssh1 at all costs PubkeyAuthentication no If you connect with a ...


7

Option 1 is I think the accepted standard. However, if you really want the extra security, why don't you have a secure server (not in your DMZ) set up to monitor your webserver, and if apache goes down, it can automatically log in remotely, and restart apache, supplying the passphrase. So the passphrase is kept on a computer, but not the same one as apache ...


7

This is expected behaviour according to the man page of ssh_config: IdentityFile Specifies a file from which the user's DSA, ECDSA or DSA authentica‐ tion identity is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for protocol version 2. Additionally, ...


7

I just set %HOME%=%HOMEPATH% This has the advantage of working for all users logged into the system (they each get separate .ssh folders). In Vista: Right-click on Computer Choose Properties Click on Advanced System Settings Click on Environment Variables In the bottom section (System Variables) Click on New For Variable name type: HOME For Variable path ...


7

Yes The "Create Certificate Request" Wizard automatically generates a new key pair. In IIS Server Certificates, I am never asked to generate nor pick a private key. This is actually not true - the wizard is just not super obvious about it. When you've entered the identity information (Common Name, Locality, Organization etc.) and hit "Next", the ...


7

To check that a certificate file certifies the public key associated with a given private key file, compare the public keys associated with each: openssl rsa -in KEYFILE -pubout openssl x509 -in CERTFILE -pubkey -noout The certificate and private key are matched if and only if the public keys are identical.


7

If it is new system, your certificate database might not be initialized. To fix this, perform: mkdir -p $HOME/.pki/nssdb certutil -d $HOME/.pki/nssdb -N


6

You need to use: ssh -i <Key file>


6

For the most part key+certificates are stored in the registry. This microsoft article covers many of the paths, and here is a blog about certificate locations. A few per-user key+certificates pairs get stored onto the filesystem. See Documents and Settings\< username >\ApplicationData\Microsoft\SystemCertificates\My\Certificates Users\< username ...


5

The actual ssh private key is stored in an encrypted format. The pass phrase is used to decrypt the private key so that is can be used. Changing the pass phrase will not affect how the key was used in the past.



Only top voted, non community-wiki answers of a minimum length are eligible