ssh-keygen — authentication key generation, management and conversion
Howto: Setup ssh authentication without password
The advantage of using these key-based authentication systems is that in many cases, it's possible to establish secure connections without having to manually type in a password.
SSH-Keygen is a Unix utility that is used to generate, manage, and convert authentication keys for ssh authentication. With the help of the SSH-Keygen tool, a user can create passphrase keys for both SSH protocol version 1 and version 2. SSH-keygen creates RSA keys for SSH protocol version 1 and RSA or DSA keys for use by SSH protocol version 2.
The SSH-keygen tool stores the private key in $HOME/.ssh/id_rsa and the public key in $HOME/.ssh/id_rsa.pub in the user’s home directory. The user should then copy the id_rsa.pub to $HOME/.ssh/authorized_keys in his home directory on the remote machine. It also asks for a passphrase. The passphrase may be empty to indicate no passphrase (host keys must have an empty passphrase), or it may be a string of arbitrary length. Instead of RSA, DSA can also be used. The steps to create authorization keys by using the SSH-keygen tool are as follows:
Start the SSH-keygen tool by using the following command to generate an RSA authentication key:
mint ~ # ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa)
Enter a passphrase for using your key:
The passphrase you will enter will be used for encrypting your private key. A good passphrase should be alphanumeric having 10-30 character length. You can also use the null passphrase however it can be a loophole for the security.
Check the Passphrase Key:
The private key was saved in .ssh/id_rsa file which is the read-only file. No one else must see the content of that file, as it is used to decrypt all correspondence encrypted with the public key. The public key is save in .ssh/id_rsa.pub file.
Copy the Public Key onto remote systems' .ssh/authorized_keys file:
Now, you have to copy the public key onto a remote systems' .ssh/authorized_keys file and make the file permissions 0x600, so it is only read/writable by you. Without these permissions, ssh will refuse to use the key. And now you can SSH to the remote systems's account without using a password. The "ssh-copy-id remotehost" command makes this 3 step process into one - logins, copies keys and changes permissions all in one go.
Files Used by SSH-Keygen utility
$HOME/.ssh/identity: The $HOME/.ssh/identity file contains the RSA private key when using the SSH protocol version 1.
$HOME/.ssh/identity.pub: The $HOME/.ssh/identity.pub file contains the RSA public key for authentication when you are using the SSH protocol version
A user should copy its contents in the $HOME/.ssh/authorized_keys file of the remote system where a user wants to log in using RSA authentication.
$HOME/.ssh/id_dsa: The $HOME/.ssh/id_dsa file contains the protocol version 2 DSA authentication identity of the user.
$HOME/.ssh/id_dsa.pub: The $HOME/.ssh/id_dsa.pub file contains the DSA public key for authentication when you are using the SSH protocol version
A user should copy its contents in the $HOME/.ssh/authorized_keys file of the remote system where a user wants to log in using DSA authentication.
$HOME/.ssh/id_rsa: The $HOME/.ssh/id_rsa file contains the protocol version 2 RSA authentication identity of the user. This file should not be readable by anyone but the user.
$HOME/.ssh/id_rsa.pub: The $HOME/.ssh/id_rsa.pub file contains the protocol version 2 RSA public key for authentication. The contents of this file should be added to $HOME/.ssh/authorized_keys on all computers where a user wishes to log in using public key authentication.
Reference: http://linux.die.net/man/1/ssh-keygen
Below shows an Example
On your client machine create the keys and copy it to the server for auto login via ssh keys.
Client Machine:
mint ~ # ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
05:fa:86:d1:f9:8e:fc:80:c8:b9:87:b8:ee:18:53:b6 root@mint
The key's randomart image is:
+--[ RSA 2048]----+
| . |
| o o |
| o o . |
| + o |
| o . S . |
| o o o + o |
|o E.+.. + . |
| +. ... o |
|.o+... . |
+-----------------+
mint ~ # cd .ssh
mint .ssh # ls -l
total 8
-rw------- 1 root root 1679 2012-03-01 10:36 id_rsa
-rw-r--r-- 1 root root 391 2012-03-01 10:36 id_rsa.pub
mint .ssh #
mint .ssh # file *
id_rsa: PEM RSA private key
id_rsa.pub: OpenSSH RSA public key
mint .ssh #
Use scp to copy the id_rsa.pub (public key) to server to authorized_keys file, this is know as Installing the public key to server.
The contents of this file should be added to ~/.ssh/authorized_keys on all machines where the user wishes to log in using public key authentication. There is no need to keep the contents of this file secret.
FILES
~/.ssh/identity
Contains the protocol version 1 RSA authentication identity of the user. This file should not be readable by anyone but the user.
It is possible to specify a passphrase when generating the key; that passphrase will be used to encrypt the private part of this
file using 3DES. This file is not automatically accessed by ssh-keygen but it is offered as the default file for the private key.
ssh(1) will read this file when a login attempt is made.
~/.ssh/identity.pub
Contains the protocol version 1 RSA public key for authentication. The contents of this file should be added to
~/.ssh/authorized_keys on all machines where the user wishes to log in using RSA authentication. There is no need to keep the con?
tents of this file secret.
~/.ssh/id_dsa
~/.ssh/id_ecdsa
~/.ssh/id_rsa
Contains the protocol version 2 DSA, ECDSA or RSA authentication identity of the user. This file should not be readable by anyone
but the user. It is possible to specify a passphrase when generating the key; that passphrase will be used to encrypt the private
part of this file using 128-bit AES. This file is not automatically accessed by ssh-keygen but it is offered as the default file
for the private key. ssh(1) will read this file when a login attempt is made.
~/.ssh/id_dsa.pub
~/.ssh/id_ecdsa.pub
~/.ssh/id_rsa.pub
Contains the protocol version 2 DSA, ECDSA or RSA public key for authentication. The contents of this file should be added to
~/.ssh/authorized_keys on all machines where the user wishes to log in using public key authentication. There is no need to keep the contents of this file secret.
