Tag Info

Hot answers tagged

103

Use the -y option to ssh-keygen: ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub From the 'man ssh-keygen' -y This option will read a private OpenSSH format file and print an OpenSSH public key to stdout. Specify the private key with the -f option, yours might be dsa instead of rsa. The name of your private key probably contains ...


44

For OpenSSH there's also BatchMode which in addition to disabling password prompting should disable querying for passphrase(s) for keys. BatchMode If set to “yes”, passphrase/password querying will be disabled. This option is useful in scripts and other batch jobs where no user is present to supply the password. The argument must be ...


32

Thinking more deeply about the authentication process, what needs to be kept secret? Amazon knows the public half of the key, and anybody can know the public half. The public half of the keypair, when matched with the private half, denotes that the private half was used to authenticate. You private key that is provided to you when Amazon generates a keypair ...


31

That is one of the reasons sudo exists. Simply allow your users to run 1 single command with only the pre-authorized command-line options and most obvious circumventions are solved. e.g. #/etc/sudoers %users ALL = (some_uid) NOPASSWD: /usr/bin/ssh -i /home/some_uid/.ssh/remote-host.key username@remotehost sets up sudo so all members of the group users ...


29

I believe there is no technical reason, it's merely an artifact of Base64 and the length of the string. Try it out with any base 64 encoder 1 -> MQ== (1 characters, 2 equals) 12 -> MTI= (2 characters, 1 equals) 123 -> MTIz (3 characters, 0 equals) 1234 -> MTIzNA== (4 characters, 2 equals) [repeat] But I may be wrong about ...


21

If you raise the LogLevel to VERBOSE in /etc/sshd/sshd_config it will log the fingerprint of the public key used to authenticate the user. LogLevel VERBOSE then you get messages like this Jul 19 11:23:13 centos sshd[13431]: Connection from 192.168.1.104 port 63529 Jul 19 11:23:13 centos sshd[13431]: Found matching RSA key: ...


18

As already mentioned by pulegium, any generic configuration management software like Puppet, Chef, Bcfg2 or cfengine could accomplish the task. Since the authorized_keys file is not that complicated, you could also use rsync or a (D)SCM like git or hg to manage this file. You have the "master" file on one of your servers and serve it via rsync/git/hg/…. On ...


18

You can have as many keys as you desire. It's good practice to use separate private/public key sets for different realms anyway, like one set for your personal use, one for your work, etc. First, generate two separate keypairs, one for home and one for work: ssh-keygen -t rsa -f ~/.ssh/id_rsa.home ssh-keygen -t rsa -f ~/.ssh/id_rsa.work Next, add an ...


18

From yum -h: --nogpgcheck disable gpg signature checking


17

Amazon provides key generation services because some operating systems (cough, Windows, cough) may not make it easy to generate the SSH keypairs. With SSH (and SFTP), the public key is installed in the user's authorized_keys file as the EC2 instance starts up. The private key is held only by the user and is presented to authenticate against the server. ...


15

Keep in mind that the server DOES have a private and public key which is completely separate from the keypair you generate as a user. The private key for the server is usually stored with the server configuration and the public key is transmitted by the server when you attempted to connect. You client compares the server's public key against your ...


14

There is a reason it is called a "Public Key" It is ment to be let out into the wild. the worst that could happen is that someone could encrypt files in such a way only your private key could decrypt it. Now if you lose you private key ... that is a whole 'nother can o worms.


13

Just add a space after the key and put in the comment, e.g.: ssh-dss AAAAB3NzaC1kc3MAAACBAN+NX/rmUkRW7Xn7faglC/pxqbVIohbcVOt41VThMYORtMQr QSqMZugxew2s9iX4qRowHWLBRci6404nSydLiDe1q6/NmpK+oQ8zD1yXekl+fruBAYeno7f6dM7c 2swwwXY6knp4umXkLItxIUki6SXM0WfabJ8BwuNDyA8IrbFAAAAFQCynEN3MYXbs4AA7E/1I03jb ...


12

Make sure the following configuration items are set like this in your sshd_config: PasswordAuthentication no UsePAM no ChallengeResponseAuthentication no


11

There is a patch available for OpenSSH that allows it to use public keys from an LDAP server, but this only really makes sense if your auth/account checks are also done against that LDAP server (which is how my environment is set up). Also it's only as secure as your LDAP configuration (so you want to be using SSL & verifying keys). See ...


10

Protocol 2 public key consist of: options, keytype, base64-encoded key, comment. There are actually more parts, but they could be (and almost always are) empty. The last part is comment and could be anything. So the answer to you question is NO, comment is not part of authentication. You could read more in documentation: ...


10

This seems like a good use case for host-based authentication. This is a method of authentication where SSH does not use an individual user's key on the local machine (in this case, your server) to authenticate; instead, it uses the host's private key, the one stored in /etc/ssh/ and which is only readable by root. To set this up, you'll need to create a ...


9

I doubt you're really using certificates for authentication. Almost all non-password-based SSH authentication is done with public-private key pairs, but without certificates getting involved at all. Before writing this Answer, I Googled, "ssh certificates", and the first 5 hits were from idiots erroneously referring to bare public keys (not certificates) ...


9

/etc/ssh/ssh_config is for the client. You want to set those options on the server config file, which is /etc/ssh/sshd_config.


9

Assuming you mean public-key-authentication on a user-level by 'certificate' and you created them by using ssh-keygen with the default location, they should be at place where your ssh-client will find them. The key consists of a private part, usually stored in ~/.ssh/id_rsa and a public part in ~/.ssh/id_rsa.pub. The last one will have to be transferred to ...


9

The scenario you describe requires multipe failures in the Web of Trust: The attacker would have to compromise the keyserver and put a fake copy of your public key there. Presumably if you're paranoid enough to use PGP you would have other people sign your key, so the attacker would have to get those people to sign the fake key (or contaminate an entire ...


9

Yes, that will do it but you should add some keys to ~/.ssh/authorized_keys of course.


9

Can anyone break the cycle for me? You are basically just experiencing the standard bootstrapping problem for public key cryptography. There are many places you can download the public keys for the various archives, but frequently they are not provided over HTTPS, and any checksum files are delivered from the same location. That wiki link you provided ...


8

I found this question when trying to answer it myself. After some searching and experimentation, I've found a few other options for this. I'm going to skip the part about distributing keys as an alternative since Matt Simmons covered that. Also, I know there are times when that is not good enough. For example, if you are GitHub and have to store millions of ...


8

This should do the trick: PubkeyAuthentication yes PasswordAuthentication no Match Address 192.168.5.* PasswordAuthentication yes The first two lines will enable pubkey authentication by default. The last line will override the other two lines for the matched network (192.168.5.0/24).


8

You are looking for Duo Security


7

add the following to your ~/.ssh/config: PasswordAuthentication no and to disable password auth on the server, add the same line to /etc/ssh/sshd_config and restart sshd.


7

Following James Sneeringer's solution, you might just want to set an ssh_config along the lines of: Host *.mycompany.com IdentityFile .ssh/id_dsa_mycompany_main Host *.mycustomer.com IdentityFile .ssh/id_dsa_mycustomer Host * RSAAuthentication no #this should be up top, avoid ssh1 at all costs PubkeyAuthentication no If you connect with a ...


7

Probably a reverse-dns lookup delay. Check your DNS configuration at server B. You can verify this by setting 'UseDNS no' in sshd_config and see if it helps. (It is preferrable, however, to solve any underlying DNS problems if there are any).



Only top voted, non community-wiki answers of a minimum length are eligible