You might have been wondering: do I really need to type in my long password every time I SSH into a remote server, possibly making a typo and starting the password all over again without seeing any feedback on the screen, hoping you get it right?
Well the good news is that there is a better way: by using certificates. If you have an SSH client on your computer you have your client ssh certificates created. These are basically the same X.509 SSL certificates you use with HTTPS, you have your public, and private keys generated and stored in the same location which is always: [userprofile]/.ssh. By the way it is the same in Windows too 🙂 , you have them under C:\Users\[username]\.ssh there. If you want to learn more about the PKI (asymmetric public-private key infrastructure) click HERE
In that location you see four important files:
- id_rsa: your private key
- id_rsa.pub: your corresponding public key
- authorized_keys: the collection of public keys of remote users who can authenticate with your account. This is the important file for us.
- known_hosts: the collection of the public keys of all the remote servers that you have ever visited
HOW IT WORKS
The idea is simple: having our public key is basically the same as having our password in hand: if we present our public key to the remote server, and the server recognizes it as a trusted user, it will log us in.
The good news is that the SSH client starts by trying your public key first by default, when that fails you are prompted for your passwords.
We simply need to add the content of our private key file (id_rsa.pub) to the “authorized_keys” file on the remote server to be able to authenticate without typing in our password.
We have two users, Bob and Bill, solving this task two different ways. Let’s see Bob.
Bob wants to connect to “web” server as root with his public key. First, he makes sure that he has his ssh certificate files inside his ~/.ssh directory.
OK, they are not there, so he creates generate them:
He is ready for the next step!
AUTOMATED WAY
On the client machine Bob issues the ssh-copy-id command for root@web as follows, he uses the server’s IP address.
He is naturally prompted for the root account’s password on the “web” machine, after he puts it in, the command does the rest of the job, adding his public key to the authorized keys on the remote box. Now he can simply log in without a password prompt
MANUAL WAY
Bill decides to do this the manual way. First, he lists the contents of his public key file and makes a copy of it.
Now he SSH into “web” as root, and opens up the /root/authorized_keys file. If he wanted to authenticate as a user called New on the same box, he would open /home/New/.ssh/authorized_keys, and append his key to the end. Note that as he is logging in as the target user on the server, he can simply use the ~ symbol that symbolizes the home folder of the target users (root or New as discussed here)
He's all done, next time he tries to log in he he does so without receiving a password prompt 😉
Comments