Thursday, February 21, 2013

Passwordless access to a *nix host via SSH

Seen this many times but it's worth a new note with some additional comments.
To access "remote server" from "local machine" I always use SSH. To make the process easy and password-free there's a quick method to store on "remote server" the public RSA key for "local machine" so that password won't be asked any longer.
  1. On "local machine" run (tested on OS X 10.8, your output may vary):
    $ ssh-keygen -t rsa
    Generating public/private rsa key pair.
    Enter file in which to save the key (/Users/<userID_1>/.ssh/id_rsa):
    Enter passphrase (empty for no passphrase): ***
    Enter same passphrase again: ***
    Your identification has been saved in /Users/<userID_1>/.ssh/id_rsa.
    Your public key has been saved in /Users/<userID_1>/.ssh/id_rsa.pub.
    The key fingerprint is:
    <long_hex_string> <userID_1>@<local machine>
    The key's randomart image is:
    ... suppressed output...
  1. The public key, id_rsa.pub, will have to be copied over to "remote server" and added to a file named authorized_keys. To simplify things, let's assume this is the first time we run this process hence id_rsa.pub will become the initial authorized_keys file:
    $ scp .ssh/id_rsa.pub <userID_2>@<remote server>:.ssh/authorized_keys

NOTE: usernames can be different between the two hosts.

Needless to say, next SSH-based authentication (from "local machine" to "remote server") will be done without requiring any passwords.

The relationship between "key fingerprint" and "public key" is also interesting since command ssh-keygen is able to hash the public key returning the host's key fingerprint:
$ ssh-keygen -lf .ssh/id_rsa    
2048 <long_hex_string> <userID_1>@<local machine> (RSA)


No comments: