Hot answers tagged public-key
70
Use the -y option to ssh-keygen:
ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub
From the 'man ssh-keygen'
-y This option will read a private OpenSSH format file and print an
OpenSSH public key to stdout.
Specify the private key with the -f option, yours might be dsa instead of rsa. The name of your private key probably contains ...
31
Thinking more deeply about the authentication process, what needs to be kept secret? Amazon knows the public half of the key, and anybody can know the public half. The public half of the keypair, when matched with the private half, denotes that the private half was used to authenticate.
You private key that is provided to you when Amazon generates a keypair ...
24
I believe there is no technical reason, it's merely an artifact of Base64 and the length of the string. Try it out with any base 64 encoder
1 -> MQ== (1 characters, 2 equals)
12 -> MTI= (2 characters, 1 equals)
123 -> MTIz (3 characters, 0 equals)
1234 -> MTIzNA== (4 characters, 2 equals)
[repeat]
But I may be wrong about ...
22
For OpenSSH there's also BatchMode which in addition to disabling password prompting should disable querying for passphrase(s) for keys.
BatchMode
If set to “yes”, passphrase/password querying will be disabled.
This option is useful in scripts and other batch jobs where no
user is present to supply the password. The argument must be
...
18
As already mentioned by pulegium, any generic configuration management software like Puppet, Chef, Bcfg2 or cfengine could accomplish the task.
Since the authorized_keys file is not that complicated, you could also use rsync or a (D)SCM like git or hg to manage this file. You have the "master" file on one of your servers and serve it via rsync/git/hg/…. On ...
17
Amazon provides key generation services because some operating systems (cough, Windows, cough) may not make it easy to generate the SSH keypairs.
With SSH (and SFTP), the public key is installed in the user's authorized_keys file as the EC2 instance starts up. The private key is held only by the user and is presented to authenticate against the server.
...
16
If you raise the LogLevel to VERBOSE in /etc/sshd/sshd_config it will log the fingerprint of the public key used to authenticate the user.
LogLevel VERBOSE
then you get messages like this
Jul 19 11:23:13 centos sshd[13431]: Connection from 192.168.1.104 port 63529
Jul 19 11:23:13 centos sshd[13431]: Found matching RSA key: ...
15
Keep in mind that the server DOES have a private and public key which is completely separate from the keypair you generate as a user. The private key for the server is usually stored with the server configuration and the public key is transmitted by the server when you attempted to connect. You client compares the server's public key against your ...
11
There is a patch available for OpenSSH that allows it to use public keys from an LDAP server, but this only really makes sense if your auth/account checks are also done against that LDAP server (which is how my environment is set up). Also it's only as secure as your LDAP configuration (so you want to be using SSL & verifying keys).
See ...
11
You can have as many keys as you desire. It's good practice to use separate private/public key sets for different realms anyway, like one set for your personal use, one for your work, etc.
First, generate two separate keypairs, one for home and one for work:
ssh-keygen -t rsa -f ~/.ssh/id_rsa.home
ssh-keygen -t rsa -f ~/.ssh/id_rsa.work
Next, add an ...
9
The scenario you describe requires multipe failures in the Web of Trust:
The attacker would have to compromise the keyserver and put a fake copy of your public key there.
Presumably if you're paranoid enough to use PGP you would have other people sign your key, so the attacker would have to get those people to sign the fake key (or contaminate an entire ...
8
I doubt you're really using certificates for authentication. Almost all non-password-based SSH authentication is done with public-private key pairs, but without certificates getting involved at all. Before writing this Answer, I Googled, "ssh certificates", and the first 5 hits were from idiots erroneously referring to bare public keys (not certificates) ...
8
This should do the trick:
PubkeyAuthentication yes
PasswordAuthentication no
Match Address 192.168.5.* PasswordAuthentication yes
The first two lines will enable pubkey authentication by default. The last line will override the other two lines for the matched network (192.168.5.0/24).
7
Well... no, that's not correct in the vast majority of circumstances due to proper randomness generation on a system. However, it is theoretically possible for a server to generate randomness that has a bias if care is not taken by the developers (in the case of Linux, the kernel developers) to ensure that the randomness source is "good". If there is a ...
7
I finally found how to convert an OpenSSH public key to PEM format on a blog and was able to successfully encrypt and decrypt a string using my private/public key.
I've outlined the steps I used to perform the encryption and decryption.
To encrypt a string:
# convert public key to PEM format
ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PKCS8 > ...
7
Red Hat have added a patch to OpenSSH in RHEL (and therefore CentOS) 6.3 to require multiple authentication mechanisms, so you can do something like this:
RequiredAuthentications2 publickey,keyboard-interactive
See the release notes for not much more detail.
Unfortunately this feature doesn't seem to be in OpenSSH upstream nor Ubuntu 12.04, so unless you ...
6
Just add a space after the key and put in the comment, e.g.:
ssh-dss AAAAB3NzaC1kc3MAAACBAN+NX/rmUkRW7Xn7faglC/pxqbVIohbcVOt41VThMYORtMQr
QSqMZugxew2s9iX4qRowHWLBRci6404nSydLiDe1q6/NmpK+oQ8zD1yXekl+fruBAYeno7f6dM7c
2swwwXY6knp4umXkLItxIUki6SXM0WfabJ8BwuNDyA8IrbFAAAAFQCynEN3MYXbs4AA7E/1I03jb
...
6
Public keys don't change just because someone removed (or changed) the passphrase on the private key. I see no reason why you would have to install this "new" public key.
I'd be concerned as to the competence of the other party if they're complaining that they have to always enter their passphrase (and that they thought it was a winning idea to remove the ...
6
Following James Sneeringer's solution, you might just want to set an ssh_config along the lines of:
Host *.mycompany.com
IdentityFile .ssh/id_dsa_mycompany_main
Host *.mycustomer.com
IdentityFile .ssh/id_dsa_mycustomer
Host *
RSAAuthentication no #this should be up top, avoid ssh1 at all costs
PubkeyAuthentication no
If you connect with a ...
5
From the answer almost the same question at stackoverflow.com (by David Tischler):
Add the following to the [ui]-section of the mercurial.ini in your home directory:
[ui]
ssh = tortoiseplink.exe -ssh -i "C:\Users\UserName\mykey.ppk"
Or if you want to specify your ssh username, add
[ui]
ssh = tortoiseplink.exe -ssh -i "C:\Users\UserName\mykey.ppk" -l ...
5
i run a very easy solution, that does the same with firewall-rules
example file hosts.conf:
192.168.0.1
192.168.2.99
192.168.2.100
distribute.sh:
#!/bin/bash
for d in `cat ./hosts.conf`; do
echo "copying to $d ...";
scp /root/.ssh./authorized_keys root@$d:/root/.ssh./authorized_keys
done;
thats the whole magic :-)
5
I am currently checking out SSH KeyDB. It is meant to do exactly that, administrate roles, servers and users, distribute user keys, gather host keys etc.
It even has something called "locations".
I haven't worked it all out yet and I am not sure if it is fully working. The code is in python however and seems to be fairly manageable, so it shouldn't be too ...
5
The main point of a private key is that it is private to the user, and known only to the user. As a user I would not want other people generating my private key because that means someone else has access to my private key and therefore has opportunity to act is if they are me on systems which have the public half of that key set as valid credentials.
From ...
5
Assuming you mean public-key-authentication on a user-level by 'certificate' and you created them by using ssh-keygen with the default location, they should be at place where your ssh-client will find them. The key consists of a private part, usually stored in ~/.ssh/id_rsa and a public part in ~/.ssh/id_rsa.pub. The last one will have to be transferred to ...
5
Generally speaking, you need to be validating keys before you trust them.
In the case that you've outlined, that would mean only trusting the key if it's given to you through a secure channel (validated SSL, for instance), or in some other way that you trust (thumbprint hash communicated through a different means for validation, for instance).
5
You can use both the Google Authenticator PAM module and public keys, but only one at the time will be used for a given authentication. That is, if a user logs in with an authorized public key, no token will be required.
Or, to say it otherwise: tokens are only required for password authentications, not SSH keys.
This limitation does not come from the ...
5
This is expected behaviour. If you provide a pass phrase when generating a key pair then the pass phrase is use to encrypt the private key. You are being asked to provide the pass phrase so that the private key can be unlocked (decrypted) before it can be used to authenticate you to the remote host.
4
I have attempted the exact same thing as you have, specifically attempting to manage Linux and Windows with the same toolset, and have found nothing but pain and frustration. The two are so very different in setup, outlook, and design assumptions that tools that work well on one (SSH, PowerShell) are ugly, fragile hacks on the other platform (yes, there ...
4
use "ssh-keygen -i" to convert SSH2-compatible format to OpenSSH compatible format
-i This option will read an unencrypted private (or public) key file in SSH2-compatible format and print an OpenSSH compatible private (or public) key to stdout. ssh-keygen also reads the RFC 4716 SSH
Public Key File Format. This option allows importing keys ...
4
It is possible since it's just an RSA key. Use openssl:
openssl rsautl -encrypt -inkey alice.pub >message.encrypted
I nicked this of this question on Unix/Linux SE.
I must say that PGP is more suitable for this.
Only top voted, non community-wiki answers of a minimum length are eligible
