Password less ssh - Revision history

Luc Morissette: Removed CentOS 7 specific configuration

2016-11-09T20:16:17Z

Removed CentOS 7 specific configuration

Luc Morissette: /* How to setup password-less SSH login */

2016-11-07T20:54:21Z

How to setup password-less SSH login

Luc Morissette: Added info for CentOS7

2016-11-07T20:51:39Z

Added info for CentOS7

Abrassard: moved Main Page/password less ssh to Password less ssh: Typo in URL when page was first created

2012-10-03T12:45:04Z

moved Main Page/password less ssh to Password less ssh: Typo in URL when page was first created

Abrassard: /* How to setup password-less SSH login */

2012-10-03T12:43:52Z

How to setup password-less SSH login

Abrassard: /* How to setup password-less SSH login */

2012-10-03T12:43:39Z

How to setup password-less SSH login

Abrassard: Created page with "= How does password-less SSH works = SSH (or SFTP, 'scp') can be used in a password-less mode, where authentication is used between client and server. When password-less mode..."

2012-10-03T12:41:28Z

Created page with "= How does password-less SSH works = SSH (or SFTP, 'scp') can be used in a password-less mode, where authentication is used between client and server. When password-less mode..."

New page

= How does password-less SSH works =
SSH (or SFTP, 'scp') can be used in a password-less mode, where authentication is used between client and server.

When password-less mode is configured, a given user on a given client server can connect through SSH to a given server without explicitly providing the password, because server has a way (through private/public key) to authenticate the client (validate that "you are who you say you are").

== How private/public keys work ==
Public/private key pairs work like this:
* Data that is encrypted with one of these keys can only be decrypted with the other (and vice versa)
* Private key is never given to anyone, used only by the owner of that key to encrypt data that it sends
* Public key is sent to anyone that needs to receive data from that owner
* Successfully decrypting data using the public key authenticates that this data was in fact send by the owner, and no one else

== Using private/public keys with SSH ==
* A private/public key pair is generated, by a given user, on the client host
** The private key is kept secret on the client host (with great care, in the user's home folder)
** The public key is sent to the server host, in the home folder of the user account on the server
* When SSH session is established
** The private key is used by client host
** The server uses the public key to authenticate the client (be sure that the client is who he pretends to be), and allows login

= Is it secure? =
Password-less SSH is known to be secure, as long as the client's private key remains private.

It it thus extremely important to keep the private key file securely on the client server, in the home directory of the user that uses it (~/.ssh/) and without any read or write permission to anyone but the owner.

= How to setup password-less SSH login =
Password-less SSH login is configured with the following steps:
* On the client host:
** Login using the user account to setup password-less SSH for
** Create the private/public key pair using the command ''ssh-keygen -t dsa''
** Do not enter a passphrase
* On the server host:
** Login using the user account that will be used for these SSH password-less connections
** Add the public key to the "authorized_keys2" file

For example:
* Generate the private/public key pair:
>ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/home/my_client_user/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/my_client_user/.ssh/id_dsa.
Your public key has been saved in /home/my_client_user/.ssh/id_dsa.pub.
The key fingerprint is:
01:23:45:67:89:01:23:45:67:89:01:23:45:67:89:01 my_client_user@my_client_host
* Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):
>cat /home/my_client_user/.ssh/id_dsa.pub | ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'
>my_server_user@my_server_host's password:
>

@@ Line 50: / Line 50: @@
 Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)
   my_server_user@my_server_host's password:
+We can also use this command to push the public key from the client host (instead of the previous command cat and ssh):
-=== CentOS 7 ===
-Note: For CentOS 7, the default is to disable key authentication and only /.ssh/authorized_keys is used (not /.ssh/authorized_keys2) <br>
-We also need to change this on the client host to allow public key Authentication:
- vi /etc/ssh/sshd_config
- PubkeyAuthentication yes
- service sshd reload
 We can also use this command to push the public key from the client host (instead of cat and ssh):
   ssh-copy-id my_server_user@my_server_host

@@ Line 51: / Line 51: @@
   my_server_user@my_server_host's password:
-Note: For CentOS 7, the default is to disable key authentication and only /.ssh/authorized_keys is used (not /.ssh/authorized_keys2)
+=== CentOS 7 ===
-We need to change this:
+Note: For CentOS 7, the default is to disable key authentication and only /.ssh/authorized_keys is used (not /.ssh/authorized_keys2) <br>
   vi /etc/ssh/sshd_config
   PubkeyAuthentication yes
   service sshd reload
-We can also use this command to push the public key from the server with the private key (instead of cat and ssh):
+We can also use this command to push the public key from the client host (instead of cat and ssh):
   ssh-copy-id my_server_user@my_server_host

← Older revision		Revision as of 20:51, 7 November 2016
Line 50:		Line 50:
	Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)		Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)
	my_server_user@my_server_host's password:		my_server_user@my_server_host's password:
		+
		+	Note: For CentOS 7, the default is to disable key authentication and only /.ssh/authorized_keys is used (not /.ssh/authorized_keys2)
		+	We need to change this:
		+	vi /etc/ssh/sshd_config
		+	PubkeyAuthentication yes
		+	service sshd reload
		+	We can also use this command to push the public key from the server with the private key (instead of cat and ssh):
		+	ssh-copy-id my_server_user@my_server_host

@@ Line 47: / Line 47: @@
 :23:45:67:89:01:23:45:67:89:01:23:45:67:89:01 my_client_user@my_client_host
 * Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):
-  >cat /home/my_client_user/.ssh/id_dsa.pub | ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'
+  cat /home/my_client_user/.ssh/id_dsa.pub | ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'
 Then you'll be prompted for the password (obviously, since password-less SSH is not yet setup!)
-  >my_server_user@my_server_host's password:
+  my_server_user@my_server_host's password:
-−

@@ Line 36: / Line 36: @@
 For example:
 * Generate the private/public key pair:
-  >ssh-keygen -t dsa
+  ssh-keygen -t dsa
   Generating public/private dsa key pair.
   Enter file in which to save the key (/home/my_client_user/.ssh/id_dsa):
@@ Line 47: / Line 48: @@
 * Upload the public key to the server (here we use a remote SSH command to append to authorized_keys2 file on the server):
   >cat /home/my_client_user/.ssh/id_dsa.pub | ssh my_server_host -l my_server_user 'sh -c "cat - >>~/.ssh/authorized_keys2"'
   >my_server_user@my_server_host's password:
+  >