Passwordless login with ssh - authorization keys generation Just at the start its worth to mention that ssh login using authorization keys is perfectly safe. There is no way to sniff the key listening to the connection. If permissions are set properly on the private key its also impossible to login to the remote machine pretending to be you. The public key kept on the remote server does not have any 'power' so even if the machine is not trusted we can keep the public key there and login into it. Even if the public key stored on remote machine is compromised attacker cant login to any server using it.
The very important note though is that the private key has to be safe! Authorization key (private key that serves as our identity) can have a password itself, but we need to keep the key without a password to be able to use it in the automated script. So the very important thing here is that the private key has to be secured. Person stealing the private key
The authentication key consists of the private key (which has to be safe so that no one except the owner can open it) and a public key which can be distributed anywhere. You take the public key, copy to remote servers, add it to authenticated keys list and you are set.
Follow commands below
To create passwordless login to remote account you have to do the following:
cd ~/.ssh ssh-keygen -f some_name -N '' -t rsa -q cp some_name id_rsa scp some_name.pub account_name@server_ip_or_name ssh account_name@server_ip_or_name cat some_name.pub >> .ssh/authorized_keys2 chmod 600 .ssh/authorized_keys2 chmod 700 .ssh
If the .ssh folders are missing on local or remote server we have to create them and set permissions to 700 (only we can access the folder).
What did we do above
The instructions above will enter the .ssh folder, create the pair of public and private keys. Private key wont have password set. We copy the private key to id_rsa so it would be used to login to remote servers. Then we login to remote machine and append the public key at the end of authenticated keys list. As i mentioned before they dont have to be secured but some systems require the file to have permissions set to 600.
Its that easy.
Comments
Post new comment