Installing ssh key

Question

I have been unsuccessfully attempting to initiate passwordless ssh. The documentation I have been able to find has been a little spotty. As far as generating the public and private keys I have attempted two different approaches: 1. use puttygen to generate the keys; 2. use the server's ssh-keygen to create the key's. This introduces my first question. Is it important to generate the key's on the local machine? Most documentation I have seen indicates this step is to be done on the local machine but nothing states why or if this is mandatory.

From this point the process seems to be to move the public key to the server's .ssh folder and use the cat command to join authorized_keys and the new public key. As I understand at this point as long as the ssh program is configured to use the key then you should be able to login without password. Unfortunately I have not had success yet. Is my understanding of the process correct? What might be causing the setup to not work? I only have limited understanding of ssh so I feel a little bit like a fish out of water. Thanks for the help!

System Setup

• Local Machine - Windows 7
• Host Machine - *nix

Update

Upon further tests based on answers here the problem ended up being a compatibility issue between putty and openssh. I resolved this by generating the keys using the server (openssh) and then used puttygen to convert the key into a putty recognized format. From here I was able to utilize pageant to make the key available to tortoiseSVN. Thanks guys!

Answer 1

It doesn't matter what machine generates the keys, as long as you have both the public and private keys. Without both, you're going to have a problem, as one decrypts what the other encrypts.

What does matter is what app is used to generate the keys. PuTTYgen will work, but for OpenSSH compatibility, of course, you will need to take the "Public key for pasting into OpehSSH authorized_keys file" and paste it into your server's per-user authorized keys file. Some servers will call it authorized_keys2, others just authorized_keys. (Depends on the version of OpenSSH, and possibly whether it's set to accept SSHv1 auth info.) You'll also need to make sure it has the right permissions on it (usually 600, and owned by the user), or OpenSSH will ignore it.

If you're using OpenSSH on both machines, stuff should just work as long as the public key is in authorized_keys (or the server's equivalent), and that file has the right permissions.

Answer 2

Is it important to generate the key's on the local machine?

Yes. Very much so. You need to generate the key as the user you will be running the ssh client as, on the machine you will be running it from. The key is tied to that identity.

As for the authorized_keys file, you need to make sure you add it to the directory specified by the sshd_config file. The default is ~/.ssh/, so look in the .ssh directory in your home on the remote computer. If there is no authorized_keys file, just create one containing the key you generated on the client. Otherwise, append it.

If it still does not work, you're either not trying to authenticate with the key (more probable), or the server does not accept key login (less probable).

In PuTTY, have you set the private key setting under Connection > SSH > Auth?

Answer 3

One of the most frequent problems with automatic keying is permissions. My usual command-line goes like this (after connecting to the machine I need to add keying to):

mkdir .ssh
cat >> .ssh/authorized_keys2
# hit paste to enter public key text, then enter, Ctrl-D, enter again
chmod -R go-rwx .ssh

That last command makes all the difference; it sets the proper *nix permissions on the files and directories so that SSH will accept them and use them properly.

Without proper permissions on the files, OpenSSH (typical server side software) will simply ignore your keys file.

If you're using Tectia to create the keys on your Windows machine, you may need to convert the format first. An OpenSSH key looks like "ssh-dss ABCD....ZYXW" in one long string. If your public key is multiple lines with "---- Public key ----" type headers, convert first. Assuming you've uploaded the public key as tectiakey.txt:

ssh-keygen -i -f tectiakey.txt >> ~/.ssh/authorized_keys2