ssh
###

:date: 2019-09-09 00:00
:modified: 2019-09-09 00:00
:tags: ssh, admin
:category: documentation
:slug: ssh
:authors: Ms.Leave-A-Mix
:summary: SSH usage and configuration

`Secure SHell`_ is a very powerful way to connect to computers remotely. It has
many uses and you may have already touched it, even without knowing it.

This article will brief up some of the use cases, and will explain the basics of
some handy tips that you may use in your daily admin (no)life.

-------------------
Authentication Keys
-------------------

In many client-server programs, authentication is one of the major problems that
the programmers encounters to make his software secure. The usual way to handle
it is a login/password system. Since it's easy to code and use, many web
services have only this way to authenticate users. This leads in the end to a
mass usage of "bot tests", and in many cases, `Google's reCaptcha`_ usage. This
is no solution for real-world web applications, and for task automation and time
saving.

The success of SSH_ is, between many of it's advantages, to handle an other way
to authenticate users. This is called "`Public Key Authentication`_", and you
can read more about it's benefits by clicking on the link.

How-To
------

This how-to will use ssh, ssh-agent, ssh-keygen, netcat and of course our
beloved bash to show how to simply authenticate to any SSH_ or Git_ server.

First, we will generate a SSH_ key pair, with or without password to protect it
:
``ssh-keygen -f new_key``
This command created two files : new_key and new_key.pub
The first one is the private part of the pair, and the ".pub" one is the public
part. We don't have to check what's inside the private key, since it's randomly
generated bytes, an human can not read it. The public key, is like a fingerprint
that will authenticate only and only if it matches with the private one.

Choose a server on which you have an user access with an SSH_ password. For
example, "nasa.gov". We will copy the newly created public key to it, and allow
the autentication with it.

``ssh-copy-id -i new_key root@nasa.gov``

Just enter your password, and it should be done. The program should output :
``Number of key(s) added: 1``

This means that you succeeded! (You can now disable SSH password login on the remote
server, huh)

SSH-Agent_ is like a keyring, it will register your keys to your session, and
will automate the authentication process when needing them. This is how you use
it :
``eval $(ssh-agent)
ssh-add ./new_key``

This program should output :
``Identity added: new_key (user@hostname)``

We then need to add some ssh client configuration, to make it automatized.

``Host *.freepoteries.fr
    ForwardAgent    yes
    User            user
    IdentityFiles   ~/new_key``

If you want to allow users to login directly to machines in the local network of
your remote host (as it is done with every virtual machine of my server). You
can also add to the options of the host :

``ProxyCommand ssh user@freepoteries.fr "-q0 %h %p" 2> /dev/null``

Save all of this in ``~/.ssh/config``.

Put this in your ``~/.bashrc`` if you want to make the ssh-agent run at each
session (read `man ssh-agent` for further information):

``if [[ "$SSH_AGENT_PID" == "" ]]; then
    eval "$(<~/.run/ssh-agent/environment)"
    ssh-add ~/.ssh/id_rsa
    ssh-add ~/.ssh/id_rsa_ma-otec
    ssh-add ~/.ssh/id_rsa_belugaspot-msleaveamix
fi``


.. _Secure SHell: https://www.ssh.com/ssh
.. _SSH: https://www.ssh.com/ssh
.. _Google's reCaptcha: https://www.google.com/recaptcha
.. _Public Key Authentication: https://www.ssh.com/ssh/public-key-authentication
.. _Git: https://git-scm.com/
.. _SSH-Agent: https://www.ssh.com/ssh/agent