Password less ssh - Revision history

Luc Morissette: Updated command line to access (need to use -i) and changed to rsa

2021-09-20T22:10:38Z

Updated command line to access (need to use -i) and changed to rsa

← Older revision		Revision as of 18:10, 20 September 2021
Line 28:		Line 28:
	* On the client host:		* On the client host:
	** Login using the user account to setup password-less SSH for		** Login using the user account to setup password-less SSH for
	** Create the private/public key pair using the command ''ssh-keygen -t ~~dsa~~''		** Create the private/public key pair using the command ''ssh-keygen -t rsa''
	** Do not enter a passphrase		** Do not enter a passphrase
	* On the server host:		* On the server host:
Line 36:		Line 36:
	For example:		For example:
	* Generate the private/public key pair:		* Generate the private/public key pair:
	ssh-keygen -t ~~dsa~~		ssh-keygen -t rsa
	The command output should look like this:		The command output should look like this:
	Generating public/private ~~dsa~~ key pair.		Generating public/private rsa key pair.
	Enter file in which to save the key (/home/my_client_user/.ssh/~~id_dsa~~):		Enter file in which to save the key (/home/my_client_user/.ssh/id_rsa):
	Enter passphrase (empty for no passphrase):		Enter passphrase (empty for no passphrase):
	Enter same passphrase again:		Enter same passphrase again:
	Your identification has been saved in /home/my_client_user/.ssh/~~id_dsa~~.		Your identification has been saved in /home/my_client_user/.ssh/id_rsa.
	Your public key has been saved in /home/my_client_user/.ssh/~~id_dsa~~.pub.		Your public key has been saved in /home/my_client_user/.ssh/id_rsa.pub.
	The key fingerprint is:		The key fingerprint is:
	01:23:45:67:89:01:23:45:67:89:01:23:45:67:89:01 my_client_user@my_client_host		01:23:45:67:89:01:23:45:67:89:01:23:45:67:89:01 my_client_user@my_client_host
	* Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):		* Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):
	cat /home/my_client_user/.ssh/~~id_dsa~~.pub \| ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'		cat /home/my_client_user/.ssh/id_rsa.pub \| ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'
	Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)		Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)
	my_server_user@my_server_host's password:		my_server_user@my_server_host's password:
	We can also use this command to push the public key from the client host (instead of the previous command cat and ssh):		We can also use this command to push the public key from the client host (instead of the previous command cat and ssh):
	ssh-copy-id my_server_user@my_server_host		ssh-copy-id my_server_user@my_server_host
			Now you can try to connect to the remote server without a password:
			ssh -i ~/.ssh/id_rsa user@remote-server

Luc Morissette: Removed CentOS 7 specific configuration

2016-11-09T20:16:17Z

Removed CentOS 7 specific configuration

← Older revision		Revision as of 16:16, 9 November 2016
Line 50:		Line 50:
	Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)		Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)
	my_server_user@my_server_host's password:		my_server_user@my_server_host's password:
			We can also use this command to push the public key from the client host (instead of the previous command cat and ssh):
	~~=== CentOS 7 ===~~
	~~Note: For CentOS 7, the default is to disable key authentication and only /.ssh/authorized_keys is used (not /.ssh/authorized_keys2) <br>~~
	~~We also need to change this on the client host to allow public key Authentication:~~
	~~vi /etc/ssh/sshd_config~~
	~~PubkeyAuthentication yes~~
	~~service sshd reload~~
	We can also use this command to push the public key from the client host (instead of cat and ssh):
	ssh-copy-id my_server_user@my_server_host		ssh-copy-id my_server_user@my_server_host

Luc Morissette: /* How to setup password-less SSH login */

2016-11-07T20:54:21Z

How to setup password-less SSH login

← Older revision		Revision as of 16:54, 7 November 2016
Line 51:		Line 51:
	my_server_user@my_server_host's password:		my_server_user@my_server_host's password:

	Note: For CentOS 7, the default is to disable key authentication and only /.ssh/authorized_keys is used (not /.ssh/authorized_keys2)		=== CentOS 7 ===
	We need to change this:		Note: For CentOS 7, the default is to disable key authentication and only /.ssh/authorized_keys is used (not /.ssh/authorized_keys2) <br>
			We also need to change this on the client host to allow public key Authentication:
	vi /etc/ssh/sshd_config		vi /etc/ssh/sshd_config
	PubkeyAuthentication yes		PubkeyAuthentication yes
	service sshd reload		service sshd reload
	We can also use this command to push the public key from the ~~server with the private key~~ (instead of cat and ssh):		We can also use this command to push the public key from the client host (instead of cat and ssh):
	ssh-copy-id my_server_user@my_server_host		ssh-copy-id my_server_user@my_server_host

Luc Morissette: Added info for CentOS7

2016-11-07T20:51:39Z

Added info for CentOS7

← Older revision		Revision as of 16:51, 7 November 2016
Line 50:		Line 50:
	Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)		Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)
	my_server_user@my_server_host's password:		my_server_user@my_server_host's password:

			Note: For CentOS 7, the default is to disable key authentication and only /.ssh/authorized_keys is used (not /.ssh/authorized_keys2)
			We need to change this:
			vi /etc/ssh/sshd_config
			PubkeyAuthentication yes
			service sshd reload
			We can also use this command to push the public key from the server with the private key (instead of cat and ssh):
			ssh-copy-id my_server_user@my_server_host

Abrassard: moved Main Page/password less ssh to Password less ssh: Typo in URL when page was first created

2012-10-03T12:45:04Z

moved Main Page/password less ssh to Password less ssh: Typo in URL when page was first created

← Older revision	Revision as of 08:45, 3 October 2012
(No difference)

Abrassard: /* How to setup password-less SSH login */

2012-10-03T12:43:52Z

How to setup password-less SSH login

← Older revision		Revision as of 08:43, 3 October 2012
Line 47:		Line 47:
	01:23:45:67:89:01:23:45:67:89:01:23:45:67:89:01 my_client_user@my_client_host		01:23:45:67:89:01:23:45:67:89:01:23:45:67:89:01 my_client_user@my_client_host
	* Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):		* Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):
	>cat /home/my_client_user/.ssh/id_dsa.pub \| ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'		cat /home/my_client_user/.ssh/id_dsa.pub \| ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'
	Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)		Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)
	>my_server_user@my_server_host's password:		my_server_user@my_server_host's password:
	>

Abrassard: /* How to setup password-less SSH login */

2012-10-03T12:43:39Z

How to setup password-less SSH login

← Older revision		Revision as of 08:43, 3 October 2012
Line 36:		Line 36:
	For example:		For example:
	* Generate the private/public key pair:		* Generate the private/public key pair:
	>ssh-keygen -t dsa		ssh-keygen -t dsa
			The command output should look like this:
	Generating public/private dsa key pair.		Generating public/private dsa key pair.
	Enter file in which to save the key (/home/my_client_user/.ssh/id_dsa):		Enter file in which to save the key (/home/my_client_user/.ssh/id_dsa):
Line 47:		Line 48:
	* Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):		* Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):
	>cat /home/my_client_user/.ssh/id_dsa.pub \| ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'		>cat /home/my_client_user/.ssh/id_dsa.pub \| ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'
			Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)
	>my_server_user@my_server_host's password:		>my_server_user@my_server_host's password:
	>		>

Abrassard: Created page with "= How does password-less SSH works = SSH (or SFTP, 'scp') can be used in a password-less mode, where authentication is used between client and server. When password-less mode..."

2012-10-03T12:41:28Z

Created page with "= How does password-less SSH works = SSH (or SFTP, 'scp') can be used in a password-less mode, where authentication is used between client and server. When password-less mode..."

New page

= How does password-less SSH works =
SSH (or SFTP, 'scp') can be used in a password-less mode, where authentication is used between client and server.

When password-less mode is configured, a given user on a given client server can connect through SSH to a given server without explicitly providing the password, because server has a way (through private/public key) to authenticate the client (validate that "you are who you say you are").

== How private/public keys work ==
Public/private key pairs work like this:
* Data that is encrypted with one of these keys can only be decrypted with the other (and vice versa)
* Private key is never given to anyone, used only by the owner of that key to encrypt data that it sends
* Public key is sent to anyone that needs to receive data from that owner
* Successfully decrypting data using the public key authenticates that this data was in fact send by the owner, and no one else

== Using private/public keys with SSH ==
* A private/public key pair is generated, by a given user, on the client host
** The private key is kept secret on the client host (with great care, in the user's home folder)
** The public key is sent to the server host, in the home folder of the user account on the server
* When SSH session is established
** The private key is used by client host
** The server uses the public key to authenticate the client (be sure that the client is who he pretends to be), and allows login

= Is it secure? =
Password-less SSH is known to be secure, as long as the client's private key remains private.

It it thus extremely important to keep the private key file securely on the client server, in the home directory of the user that uses it (~/.ssh/) and without any read or write permission to anyone but the owner.

= How to setup password-less SSH login =
Password-less SSH login is configured with the following steps:
* On the client host:
** Login using the user account to setup password-less SSH for
** Create the private/public key pair using the command ''ssh-keygen -t dsa''
** Do not enter a passphrase
* On the server host:
** Login using the user account that will be used for these SSH password-less connections
** Add the public key to the "authorized_keys2" file

For example:
* Generate the private/public key pair:
>ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/home/my_client_user/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/my_client_user/.ssh/id_dsa.
Your public key has been saved in /home/my_client_user/.ssh/id_dsa.pub.
The key fingerprint is:
01:23:45:67:89:01:23:45:67:89:01:23:45:67:89:01 my_client_user@my_client_host
* Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):
>cat /home/my_client_user/.ssh/id_dsa.pub | ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'
>my_server_user@my_server_host's password:
>