142 lines
4.5 KiB
ReStructuredText
142 lines
4.5 KiB
ReStructuredText
ssh
|
|
###
|
|
|
|
:date: 2019-09-09 00:00
|
|
:modified: 2019-09-09 00:00
|
|
:tags: ssh, admin
|
|
:category: documentation
|
|
:slug: ssh
|
|
:authors: Ms.Leave-A-Mix
|
|
:summary: SSH usage and configuration
|
|
|
|
`Secure SHell`_ is a very powerful way to connect to computers remotely. It has
|
|
many uses and you may have already touched it, even without knowing it.
|
|
|
|
This article will brief up some of the use cases, and will explain the basics of
|
|
some handy tips that you may use in your daily admin (no)life.
|
|
|
|
-------------------
|
|
Authentication Keys
|
|
-------------------
|
|
|
|
In many client-server programs, authentication is one of the major problems that
|
|
the programmers encounters to make his software secure. The usual way to handle
|
|
it is a login/password system. Since it's easy to code and use, many web
|
|
services have only this way to authenticate users. This leads in the end to a
|
|
mass usage of "bot tests", and in many cases, `Google's reCaptcha`_ usage. This
|
|
is no solution for real-world web applications, and for task automation and time
|
|
saving.
|
|
|
|
The success of SSH_ is, between many of it's advantages, to handle an other way
|
|
to authenticate users. This is called "`Public Key Authentication`_", and you
|
|
can read more about it's benefits by clicking on the link.
|
|
|
|
How-To
|
|
------
|
|
|
|
This how-to will use ssh, ssh-agent, ssh-keygen, netcat and of course our
|
|
beloved bash to show how to simply authenticate to any SSH_ or Git_ server.
|
|
|
|
First, we will generate a SSH_ key pair, with or without password to protect it:
|
|
|
|
.. code-block:: bash
|
|
|
|
ssh-keygen -f new_key
|
|
|
|
This command created two files : new_key and new_key.pub
|
|
The first one is the private part of the pair, and the ".pub" one is the public
|
|
part. We don't have to check what's inside the private key, since it's randomly
|
|
generated bytes, an human can not read it. The public key, is like a fingerprint
|
|
that will authenticate only and only if it matches with the private one.
|
|
|
|
Choose a server on which you have an user access with an SSH_ password. For
|
|
example, "nasa.gov". We will copy the newly created public key to it, and allow
|
|
the autentication with it:
|
|
|
|
.. code-block:: bash
|
|
|
|
ssh-copy-id -i new_key root@nasa.gov
|
|
|
|
Just enter your password, and it should be done. The program should output:
|
|
|
|
.. code-block:: bash
|
|
|
|
Number of key(s) added: 1
|
|
|
|
This means that you succeeded! (You can now disable SSH password login on the remote
|
|
server, huh)
|
|
|
|
SSH-Agent_ is like a keyring, it will register your keys to your session, and
|
|
will automate the authentication process when needing them. This is how you use
|
|
it:
|
|
|
|
.. code-block:: bash
|
|
|
|
eval $(ssh-agent)
|
|
ssh-add ./new_key
|
|
|
|
This program should output:
|
|
|
|
.. code-block:: bash
|
|
|
|
Identity added: new_key (user@hostname)
|
|
|
|
We then need to add some ssh client configuration, to make it automatized:
|
|
|
|
.. code-block:: bash
|
|
|
|
Host \*.freepoteries.fr
|
|
ForwardAgent yes
|
|
User user
|
|
IdentityFiles ~/new_key
|
|
|
|
If you want to allow users to login directly to machines in the local network of
|
|
your remote host (as it is done with every virtual machine of my server). You
|
|
can also add to the options of the host:
|
|
|
|
.. code-block:: bash
|
|
|
|
ProxyCommand ssh user@freepoteries.fr "-q0 %h %p" 2> /dev/null
|
|
|
|
Save all of this in **~/.ssh/config**.
|
|
|
|
Put this in your **~/.bashrc** if you want to make the ssh-agent run at each
|
|
session (read **man ssh-agent** for further information):
|
|
|
|
.. code-block:: bash
|
|
|
|
if [[ "$SSH_AGENT_PID" == "" ]]; then
|
|
eval "$(<~/.run/ssh-agent/environment)"
|
|
ssh-add ~/.ssh/id_rsa
|
|
ssh-add ~/.ssh/id_rsa_ma-otec
|
|
ssh-add ~/.ssh/id_rsa_belugaspot-msleaveamix
|
|
fi
|
|
|
|
Git_ users! Don't be fooled, your SSH authentication to repositories as of the
|
|
sources of freepoteries-doc_, by adding this snippet to your **~/.ssh/config**:
|
|
|
|
.. code-block:: bash
|
|
|
|
Host git.yannweb.net
|
|
User git
|
|
Port 2222
|
|
IdentityFile ~/new_key
|
|
ForwardAgent yes
|
|
|
|
|
|
If this doesn't work, you may want to verify that the keys are correctly loaded,
|
|
to do this, run:
|
|
|
|
.. code-block:: bash
|
|
|
|
(arch)emixam@archlinux:~$ ssh-add -l
|
|
2048 SHA256:S4LpyvoqT3wBBNYlosJkX6VFPQ00BoBu6LJ/IJWywOw /home/emixam/.ssh/id_rsa (RSA)
|
|
|
|
.. _Secure SHell: https://www.ssh.com/ssh
|
|
.. _SSH: https://www.ssh.com/ssh
|
|
.. _Google's reCaptcha: https://www.google.com/recaptcha
|
|
.. _Public Key Authentication: https://www.ssh.com/ssh/public-key-authentication
|
|
.. _Git: https://git-scm.com/
|
|
.. _SSH-Agent: https://www.ssh.com/ssh/agent
|
|
.. _freepoteries-doc: ssh://git@git.yannweb.net:2222/maxime-alves/freepoteries-doc.git
|