08-23-2007
ssh-keygen questions (not working) --> resolved
OK. It does pay to know which ssh you are using.
$ ssh -V
OpenSSH_3.6.1p2, SSH protocols 1.5/2.0, OpenSSL 0x0090605f
this pointed me to the proper syntax for using private/public keys and ssh
public/private passwordless keys using: ksh and OpenSSH
This process allows an ssh connection between 2 servers without command-line authentication and run commands via a program.
From the server you will be connecting from: create a key pair:
ssh-keygen -t rsa #note: I did not use passphrase - just hit ‘enter'
<<output to screen>>
Generating public/private rsa key pair.
Enter file in which to save the key (/home/WebARCH/ol_inv/.ssh/id_rsa):
Created directory '/home/WebARCH/ol_inv/.ssh'.
Enter passphrase (empty for no passphrase): <press enter key and bypass>
Enter same passphrase again: <press enter key and bypass>
Your identification has been saved in /home/djm/.ssh/id_rsa.
Your public key has been saved in /home/djm/.ssh/id_rsa.pub.
The key fingerprint is:
3c:7e:41:2c:d2:51:f8:0b:ef:78:e7:e3:22:eb:af:6a ol_inv@dpbmdb2
Once you have generated a key pair, you must now install the public key on the server that you wish to log into. The public portion is stored in the file with the extension .pub in an ASCII encoding. Note: it is all one continuous line without line breaks.
Now you need to move that public key to the remote server paying close attention to file permissions. UNIX is very particular when it comes to file permissions. In order for the private key (resides on the source server ‘.ssh/id_rsa' to be recognized there cannot be any permissions for group or other, just for user:
-rw------- 1 ol_inv whs 883 Aug 23 09:26 id_rsa
To enable public key authentication on a server, you need to append the public portion of the key to the/.ssh/authorized_keys file. This may be accomplished with the following command-line:
ssh dwebapp1 "umask 077; cat >> .ssh/authorized_keys" </.ssh/id_rsa.pub
^^^^^^^^ ^^^^^^^^^^^^
Remote server Source server
The restrictive umask is required because the server will refuse to read/.ssh/authorized_keys files which have loose permissions. Once the public key is installed on the server, you should now be able to authenticate using your private key
Test your keys:
ssh username@host
If you do not see your remote server's splash page and you see the following page:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for '/usr/local/ol_inv/.ssh/id_rsa' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: /usr/local/ol_inv/.ssh/id_rsa
Enter passphrase for key '/usr/local/ol_inv/.ssh/id_rsa':
Then you need to go back and check the permissions on the source server where the private key resides: id_rsa
After you correct your permissions on that file:
chmod 700 id_rsa
Try again:
ssh remoteuser@remoteserver
Note: replace remoteuser with actual user name on remote server
replace remoteserver with actual remote server name
10 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
Hello friends,
I wanna to make new script which work as i defined below
(1) it connect (using ssh) to remote server
(2) remote server having passphrase key with password
(3) Generate new passphrase on local machine with random 8 character password.
(4) It will atomatically uploaded to... (4 Replies)
Discussion started by: jagnikam
4 Replies
2. UNIX for Advanced & Expert Users
Hey guys,
I was using ssh-keygen settings for a long time to login on remote machines without password.
2 days back it suddenly stops working, i tried by reset all ssh-keygen setting but it not works.
what could be the reason of this issue and how can i resolve this? (2 Replies)
Discussion started by: RohitKJ
2 Replies
3. Shell Programming and Scripting
Hi,
I have two Unix servers A and B. I have a script in server A. I want to connect to server B from A using ssh only and without giving passwords everytime i connect. I went through other posts regarding this and I generated a public key in server A and copied that in server B. Now when I... (3 Replies)
Discussion started by: mick_000
3 Replies
4. UNIX for Dummies Questions & Answers
Hi,
I am new to unix, recently i was exploring password less remote connection to the ftp server and in that I was exploring the ssh-keygen utility, that it generates private & public keys that helps in transmitting files in encrypted format.Could you please explain me in detail about the... (1 Reply)
Discussion started by: rahul125
1 Replies
5. UNIX for Dummies Questions & Answers
Hi,
I was going thruough the password less authentication of keygen-ssh that will help us in generating keys...One thing that is not clear to me that if in nearby future we conncet to remote ftp server in that case now we need to only provide the user id itself that is password would not be... (1 Reply)
Discussion started by: rahul125
1 Replies
6. UNIX for Dummies Questions & Answers
Hi,
I using ssh-keygen for passwordless authenciation firstly
and I am following these steps mentioned below...
1) Login to pngpcdb1 using your user/pass
2) type 'bash' (without quotes)
3) ssh-keygen #generates private and public key.
4) copy this private key to the location of your sftp... (1 Reply)
Discussion started by: karan2597
1 Replies
7. Shell Programming and Scripting
sftp username@host <<EOF
lcd /home/dirA
cd /home/dirB
mput *.txt
exit
EOF
Hi,
i have done the keygen-ssh settings but rite now I log through putty I enter my credentials and then when i successfully log in, then I issue the command ssh server name then I again enter into the server but... (1 Reply)
Discussion started by: rahulsxn660
1 Replies
8. UNIX for Dummies Questions & Answers
Hi,
I have a generic id say "abc". In a client i logged into using this generic id and generated the key for autologin to do ssh to a server.
I have kept the key in authorized_keys file in the server under the home directory of this generic id. (/u/abc/.ssh/authorized_keys)
when i do... (7 Replies)
Discussion started by: rbalaj16
7 Replies
9. Cybersecurity
When using ssh-keygen what does it look at to build the ssh keys? (1 Reply)
Discussion started by: toor13
1 Replies
10. UNIX for Beginners Questions & Answers
For some reason, when I try copying my public key to the server, despite it showing as being successful:
rob@linux044:~$ ssh-copy-id -i /home/rob/Work/Keys/keys.txt.pub !@#$%.com
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/rob/Work/Keys/keys.txt.pub"... (7 Replies)
Discussion started by: Circuits
7 Replies
SSH-ADD(1) BSD General Commands Manual SSH-ADD(1)
NAME
ssh-add -- adds RSA or DSA identities to the authentication agent
SYNOPSIS
ssh-add [-cDdLlXx] [-t life] [file ...]
ssh-add -s pkcs11
ssh-add -e pkcs11
DESCRIPTION
ssh-add adds RSA or DSA identities to the authentication agent, ssh-agent(1). When run without arguments, it adds the files ~/.ssh/id_rsa,
~/.ssh/id_dsa and ~/.ssh/identity. After loading a private key, ssh-add will try to load corresponding certificate information from the
filename obtained by appending -cert.pub to the name of the private key file. Alternative file names can be given on the command line.
If any file requires a passphrase, ssh-add asks for the passphrase from the user. The passphrase is read from the user's tty. ssh-add
retries the last passphrase if multiple identity files are given.
The authentication agent must be running and the SSH_AUTH_SOCK environment variable must contain the name of its socket for ssh-add to work.
The options are as follows:
-c Indicates that added identities should be subject to confirmation before being used for authentication. Confirmation is performed by
the SSH_ASKPASS program mentioned below. Successful confirmation is signaled by a zero exit status from the SSH_ASKPASS program,
rather than text entered into the requester.
-D Deletes all identities from the agent.
-d Instead of adding identities, removes identities from the agent. If ssh-add has been run without arguments, the keys for the default
identities will be removed. Otherwise, the argument list will be interpreted as a list of paths to public key files and matching
keys will be removed from the agent. If no public key is found at a given path, ssh-add will append .pub and retry.
-e pkcs11
Remove keys provided by the PKCS#11 shared library pkcs11.
-L Lists public key parameters of all identities currently represented by the agent.
-l Lists fingerprints of all identities currently represented by the agent.
-s pkcs11
Add keys provided by the PKCS#11 shared library pkcs11.
-t life
Set a maximum lifetime when adding identities to an agent. The lifetime may be specified in seconds or in a time format specified in
sshd_config(5).
-X Unlock the agent.
-x Lock the agent with a password.
ENVIRONMENT
DISPLAY and SSH_ASKPASS
If ssh-add needs a passphrase, it will read the passphrase from the current terminal if it was run from a terminal. If ssh-add does
not have a terminal associated with it but DISPLAY and SSH_ASKPASS are set, it will execute the program specified by SSH_ASKPASS and
open an X11 window to read the passphrase. This is particularly useful when calling ssh-add from a .xsession or related script.
(Note that on some machines it may be necessary to redirect the input from /dev/null to make this work.)
SSH_AUTH_SOCK
Identifies the path of a UNIX-domain socket used to communicate with the agent.
FILES
~/.ssh/identity
Contains the protocol version 1 RSA authentication identity of the user.
~/.ssh/id_dsa
Contains the protocol version 2 DSA authentication identity of the user.
~/.ssh/id_rsa
Contains the protocol version 2 RSA authentication identity of the user.
Identity files should not be readable by anyone but the user. Note that ssh-add ignores identity files if they are accessible by others.
DIAGNOSTICS
Exit status is 0 on success, 1 if the specified command fails, and 2 if ssh-add is unable to contact the authentication agent.
SEE ALSO
ssh(1), ssh-agent(1), ssh-keygen(1), sshd(8)
AUTHORS
OpenSSH is a derivative of the original and free ssh 1.2.12 release by Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
Theo de Raadt and Dug Song removed many bugs, re-added newer features and created OpenSSH. Markus Friedl contributed the support for SSH
protocol versions 1.5 and 2.0.
BSD
March 5, 2010 BSD