Tag Info

Hot answers tagged

93

Use the -y option to ssh-keygen: ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub From the 'man ssh-keygen' -y This option will read a private OpenSSH format file and print an OpenSSH public key to stdout. Specify the private key with the -f option, yours might be dsa instead of rsa. The name of your private key probably contains ...


39

For OpenSSH there's also BatchMode which in addition to disabling password prompting should disable querying for passphrase(s) for keys. BatchMode If set to “yes”, passphrase/password querying will be disabled. This option is useful in scripts and other batch jobs where no user is present to supply the password. The argument must be ...


31

Thinking more deeply about the authentication process, what needs to be kept secret? Amazon knows the public half of the key, and anybody can know the public half. The public half of the keypair, when matched with the private half, denotes that the private half was used to authenticate. You private key that is provided to you when Amazon generates a keypair ...


27

I believe there is no technical reason, it's merely an artifact of Base64 and the length of the string. Try it out with any base 64 encoder 1 -> MQ== (1 characters, 2 equals) 12 -> MTI= (2 characters, 1 equals) 123 -> MTIz (3 characters, 0 equals) 1234 -> MTIzNA== (4 characters, 2 equals) [repeat] But I may be wrong about ...


19

If you raise the LogLevel to VERBOSE in /etc/sshd/sshd_config it will log the fingerprint of the public key used to authenticate the user. LogLevel VERBOSE then you get messages like this Jul 19 11:23:13 centos sshd[13431]: Connection from 192.168.1.104 port 63529 Jul 19 11:23:13 centos sshd[13431]: Found matching RSA key: ...


18

As already mentioned by pulegium, any generic configuration management software like Puppet, Chef, Bcfg2 or cfengine could accomplish the task. Since the authorized_keys file is not that complicated, you could also use rsync or a (D)SCM like git or hg to manage this file. You have the "master" file on one of your servers and serve it via rsync/git/hg/…. On ...


17

Amazon provides key generation services because some operating systems (cough, Windows, cough) may not make it easy to generate the SSH keypairs. With SSH (and SFTP), the public key is installed in the user's authorized_keys file as the EC2 instance starts up. The private key is held only by the user and is presented to authenticate against the server. ...


15

Keep in mind that the server DOES have a private and public key which is completely separate from the keypair you generate as a user. The private key for the server is usually stored with the server configuration and the public key is transmitted by the server when you attempted to connect. You client compares the server's public key against your ...


14

There is a reason it is called a "Public Key" It is ment to be let out into the wild. the worst that could happen is that someone could encrypt files in such a way only your private key could decrypt it. Now if you lose you private key ... that is a whole 'nother can o worms.


12

Make sure the following configuration items are set like this in your sshd_config: PasswordAuthentication no UsePAM no ChallengeResponseAuthentication no


12

From yum -h: --nogpgcheck disable gpg signature checking


12

You can have as many keys as you desire. It's good practice to use separate private/public key sets for different realms anyway, like one set for your personal use, one for your work, etc. First, generate two separate keypairs, one for home and one for work: ssh-keygen -t rsa -f ~/.ssh/id_rsa.home ssh-keygen -t rsa -f ~/.ssh/id_rsa.work Next, add an ...


12

Just add a space after the key and put in the comment, e.g.: ssh-dss AAAAB3NzaC1kc3MAAACBAN+NX/rmUkRW7Xn7faglC/pxqbVIohbcVOt41VThMYORtMQr QSqMZugxew2s9iX4qRowHWLBRci6404nSydLiDe1q6/NmpK+oQ8zD1yXekl+fruBAYeno7f6dM7c 2swwwXY6knp4umXkLItxIUki6SXM0WfabJ8BwuNDyA8IrbFAAAAFQCynEN3MYXbs4AA7E/1I03jb ...


11

There is a patch available for OpenSSH that allows it to use public keys from an LDAP server, but this only really makes sense if your auth/account checks are also done against that LDAP server (which is how my environment is set up). Also it's only as secure as your LDAP configuration (so you want to be using SSL & verifying keys). See ...


9

I doubt you're really using certificates for authentication. Almost all non-password-based SSH authentication is done with public-private key pairs, but without certificates getting involved at all. Before writing this Answer, I Googled, "ssh certificates", and the first 5 hits were from idiots erroneously referring to bare public keys (not certificates) ...


9

The scenario you describe requires multipe failures in the Web of Trust: The attacker would have to compromise the keyserver and put a fake copy of your public key there. Presumably if you're paranoid enough to use PGP you would have other people sign your key, so the attacker would have to get those people to sign the fake key (or contaminate an entire ...


9

Yes, that will do it but you should add some keys to ~/.ssh/authorized_keys of course.


8

Can anyone break the cycle for me? You are basically just experiencing the standard bootstrapping problem for public key cryptography. There are many places you can download the public keys for the various archives, but frequently they are not provided over HTTPS, and any checksum files are delivered from the same location. That wiki link you provided ...


8

/etc/ssh/ssh_config is for the client. You want to set those options on the server config file, which is /etc/ssh/sshd_config.


8

This should do the trick: PubkeyAuthentication yes PasswordAuthentication no Match Address 192.168.5.* PasswordAuthentication yes The first two lines will enable pubkey authentication by default. The last line will override the other two lines for the matched network (192.168.5.0/24).


7

Assuming you mean public-key-authentication on a user-level by 'certificate' and you created them by using ssh-keygen with the default location, they should be at place where your ssh-client will find them. The key consists of a private part, usually stored in ~/.ssh/id_rsa and a public part in ~/.ssh/id_rsa.pub. The last one will have to be transferred to ...


7

Well... no, that's not correct in the vast majority of circumstances due to proper randomness generation on a system. However, it is theoretically possible for a server to generate randomness that has a bias if care is not taken by the developers (in the case of Linux, the kernel developers) to ensure that the randomness source is "good". If there is a ...


7

Probably a reverse-dns lookup delay. Check your DNS configuration at server B. You can verify this by setting 'UseDNS no' in sshd_config and see if it helps. (It is preferrable, however, to solve any underlying DNS problems if there are any).


7

Red Hat have added a patch to OpenSSH in RHEL (and therefore CentOS) 6.3 to require multiple authentication mechanisms, so you can do something like this: RequiredAuthentications2 publickey,keyboard-interactive See the release notes for not much more detail. Unfortunately this feature doesn't seem to be in OpenSSH upstream nor Ubuntu 12.04, so unless you ...


7

You are looking for Duo Security


7

I finally found how to convert an OpenSSH public key to PEM format on a blog and was able to successfully encrypt and decrypt a string using my private/public key. I've outlined the steps I used to perform the encryption and decryption. To encrypt a string: # convert public key to PEM format ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PKCS8 > ...


6

For some reason, SELinux denied access to authorized_keys from sshd. Fixed this with /sbin/restorecon -v ~/.ssh/authorized_keys


6

The ASCII characters you see are an ASCII-encoded certificate, according to the SSL standards. There are a number of tools you can use to decode (rather than decrypt) the certificate; here's an example: [me@anni tmp]$ cat /tmp/cert -----BEGIN CERTIFICATE----- MIIFNDCCBBygAwIBAgIDB9RMMA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT [many lines deleted to save ...


6

Following James Sneeringer's solution, you might just want to set an ssh_config along the lines of: Host *.mycompany.com IdentityFile .ssh/id_dsa_mycompany_main Host *.mycustomer.com IdentityFile .ssh/id_dsa_mycustomer Host * RSAAuthentication no #this should be up top, avoid ssh1 at all costs PubkeyAuthentication no If you connect with a ...



Only top voted, non community-wiki answers of a minimum length are eligible