ssh
###

:date: 2019-09-09 00:00
:modified: 2019-09-09 00:00
:tags: ssh, admin
:category: documentation
:slug: ssh
:authors: Ms.Leave-A-Mix
:summary: SSH usage and configuration

`Secure SHell`_ is a very powerful way to connect to computers remotely. It has
many uses and you may have already touched it, even without knowing it.

This article will brief up some of the use cases, and will explain the basics of
some handy tips that you may use in your daily admin (no)life.

-------------------
Authentication Keys
-------------------

In many client-server programs, authentication is one of the major problems that
the programmers encounters to make his software secure. The usual way to handle
it is a login/password system. Since it's easy to code and use, many web
services have only this way to authenticate users. This leads in the end to a
mass usage of "bot tests", and in many cases, `Google's reCaptcha`_ usage. This
is no solution for real-world web applications, and for task automation and time
saving.

The success of SSH_ is, between many of it's advantages, to handle an other way
to authenticate users. This is called "`Public Key Authentication`_", and you
can read more about it's benefits by clicking on the link.

How-To
------

This how-to will use ssh, ssh-agent, ssh-keygen, netcat and of course our
beloved bash to show how to simply authenticate to any SSH_ or Git_ server.

First, we will generate a SSH_ key pair, with or without password to protect it:

.. code-block:: bash

    ssh-keygen -f new_key

This command created two files : new_key and new_key.pub
The first one is the private part of the pair, and the ".pub" one is the public
part. We don't have to check what's inside the private key, since it's randomly
generated bytes, an human can not read it. The public key, is like a fingerprint
that will authenticate only and only if it matches with the private one.

Choose a server on which you have an user access with an SSH_ password. For
example, "nasa.gov". We will copy the newly created public key to it, and allow
the autentication with it:

.. code-block:: bash

    ssh-copy-id -i new_key root@nasa.gov

Just enter your password, and it should be done. The program should output:

.. code-block:: bash

    Number of key(s) added: 1

This means that you succeeded! (You can now disable SSH password login on the remote
server, huh)

SSH-Agent_ is like a keyring, it will register your keys to your session, and
will automate the authentication process when needing them. This is how you use
it:

.. code-block:: bash

    eval $(ssh-agent)
    ssh-add ./new_key

This program should output:

.. code-block:: bash

    Identity added: new_key (user@hostname)

We then need to add some ssh client configuration, to make it automatized:

.. code-block:: bash

    Host \*.freepoteries.fr
        ForwardAgent    yes
        User            user
        IdentityFiles   ~/new_key

If you want to allow users to login directly to machines in the local network of
your remote host (as it is done with every virtual machine of my server). You
can also add to the options of the host:

.. code-block:: bash

    ProxyCommand ssh user@freepoteries.fr "-q0 %h %p" 2> /dev/null

Save all of this in **~/.ssh/config**.

Put this in your **~/.bashrc** if you want to make the ssh-agent run at each
session (read **man ssh-agent** for further information):

.. code-block:: bash

    if [[ "$SSH_AGENT_PID" == "" ]]; then
        eval "$(<~/.run/ssh-agent/environment)"
        ssh-add ~/.ssh/id_rsa
        ssh-add ~/.ssh/id_rsa_ma-otec
        ssh-add ~/.ssh/id_rsa_belugaspot-msleaveamix
    fi

Git_ users! Don't be fooled, your SSH authentication to repositories as of the
sources of freepoteries-doc_, by adding this snippet to your **~/.ssh/config**:

.. code-block:: bash

    Host git.yannweb.net
        User            git
        Port            2222
        IdentityFile    ~/new_key
        ForwardAgent    yes


If this doesn't work, you may want to verify that the keys are correctly loaded,
to do this, run:

.. code-block:: bash

    (arch)emixam@archlinux:~$ ssh-add -l
        2048 SHA256:S4LpyvoqT3wBBNYlosJkX6VFPQ00BoBu6LJ/IJWywOw /home/emixam/.ssh/id_rsa (RSA)

.. _Secure SHell: https://www.ssh.com/ssh
.. _SSH: https://www.ssh.com/ssh
.. _Google's reCaptcha: https://www.google.com/recaptcha
.. _Public Key Authentication: https://www.ssh.com/ssh/public-key-authentication
.. _Git: https://git-scm.com/
.. _SSH-Agent: https://www.ssh.com/ssh/agent
.. _freepoteries-doc: ssh://git@git.yannweb.net:2222/maxime-alves/freepoteries-doc.git