102 lines
3.6 KiB
ReStructuredText
102 lines
3.6 KiB
ReStructuredText
ssh
|
|
###
|
|
|
|
:date: 2019-09-09 00:00
|
|
:modified: 2019-09-09 00:00
|
|
:tags: ssh, admin
|
|
:category: documentation
|
|
:slug: ssh
|
|
:authors: Ms.Leave-A-Mix
|
|
:summary: SSH usage and configuration
|
|
|
|
`Secure SHell`_ is a very powerful way to connect to computers remotely. It has
|
|
many uses and you may have already touched it, even without knowing it.
|
|
|
|
This article will brief up some of the use cases, and will explain the basics of
|
|
some handy tips that you may use in your daily admin (no)life.
|
|
|
|
-------------------
|
|
Authentication Keys
|
|
-------------------
|
|
|
|
In many client-server programs, authentication is one of the major problems that
|
|
the programmers encounters to make his software secure. The usual way to handle
|
|
it is a login/password system. Since it's easy to code and use, many web
|
|
services have only this way to authenticate users. This leads in the end to a
|
|
mass usage of "bot tests", and in many cases, `Google's reCaptcha`_ usage. This
|
|
is no solution for real-world web applications, and for task automation and time
|
|
saving.
|
|
|
|
The success of SSH_ is, between many of it's advantages, to handle an other way
|
|
to authenticate users. This is called "`Public Key Authentication`_", and you
|
|
can read more about it's benefits by clicking on the link.
|
|
|
|
How-To
|
|
------
|
|
|
|
This how-to will use ssh, ssh-agent, ssh-keygen, netcat and of course our
|
|
beloved bash to show how to simply authenticate to any SSH_ or Git_ server.
|
|
|
|
First, we will generate a SSH_ key pair, with or without password to protect it
|
|
:
|
|
``ssh-keygen -f new_key``
|
|
This command created two files : new_key and new_key.pub
|
|
The first one is the private part of the pair, and the ".pub" one is the public
|
|
part. We don't have to check what's inside the private key, since it's randomly
|
|
generated bytes, an human can not read it. The public key, is like a fingerprint
|
|
that will authenticate only and only if it matches with the private one.
|
|
|
|
Choose a server on which you have an user access with an SSH_ password. For
|
|
example, "nasa.gov". We will copy the newly created public key to it, and allow
|
|
the autentication with it.
|
|
|
|
``ssh-copy-id -i new_key root@nasa.gov``
|
|
|
|
Just enter your password, and it should be done. The program should output :
|
|
``Number of key(s) added: 1``
|
|
|
|
This means that you succeeded! (You can now disable SSH password login on the remote
|
|
server, huh)
|
|
|
|
SSH-Agent_ is like a keyring, it will register your keys to your session, and
|
|
will automate the authentication process when needing them. This is how you use
|
|
it :
|
|
``eval $(ssh-agent)
|
|
ssh-add ./new_key``
|
|
|
|
This program should output :
|
|
``Identity added: new_key (user@hostname)``
|
|
|
|
We then need to add some ssh client configuration, to make it automatized.
|
|
|
|
``Host *.freepoteries.fr
|
|
ForwardAgent yes
|
|
User user
|
|
IdentityFiles ~/new_key``
|
|
|
|
If you want to allow users to login directly to machines in the local network of
|
|
your remote host (as it is done with every virtual machine of my server). You
|
|
can also add to the options of the host :
|
|
|
|
``ProxyCommand ssh user@freepoteries.fr "-q0 %h %p" 2> /dev/null``
|
|
|
|
Save all of this in ``~/.ssh/config``.
|
|
|
|
Put this in your ``~/.bashrc`` if you want to make the ssh-agent run at each
|
|
session (read `man ssh-agent` for further information):
|
|
|
|
``if [[ "$SSH_AGENT_PID" == "" ]]; then
|
|
eval "$(<~/.run/ssh-agent/environment)"
|
|
ssh-add ~/.ssh/id_rsa
|
|
ssh-add ~/.ssh/id_rsa_ma-otec
|
|
ssh-add ~/.ssh/id_rsa_belugaspot-msleaveamix
|
|
fi``
|
|
|
|
|
|
.. _Secure SHell: https://www.ssh.com/ssh
|
|
.. _SSH: https://www.ssh.com/ssh
|
|
.. _Google's reCaptcha: https://www.google.com/recaptcha
|
|
.. _Public Key Authentication: https://www.ssh.com/ssh/public-key-authentication
|
|
.. _Git: https://git-scm.com/
|
|
.. _SSH-Agent: https://www.ssh.com/ssh/agent
|