Skip to content

Latest commit

 

History

History
105 lines (75 loc) · 2.45 KB

ssh.md

File metadata and controls

105 lines (75 loc) · 2.45 KB
Raw

ssh

general information on pki and mfa

pki do's and don'ts

  • do not write your passphrase in a publicly-readable place.
  • do not share your passphrase with anyone.
  • do not use a blank passphrase.
  • do not write your private key in a publicly-readable place.
  • do not share your private key with anyone.
  • do share your public key.

local keys

permissions

  • ~/.ssh (directory): 700 (drwx------)
  • ~/.ssh/key_name.pub (public keys): 644 (-rw-r--r--)
  • ~/.ssh/key_name (private keys): 600 (-rw-------)
  • ~/.ssh/authorized_keys (public keys allowed by server): 644 (-rw-r--r--)

generate a keypair

 $ cd ~/.ssh
 $ ssh-keygen -b 4096 -f ./username_domain

use private keys with non-default names

 $ echo "identityfile ~/.ssh/firstname-lastnme" >> ~/.ssh/config

generate public key from private key

$ ssh-keygen -l -f ~/.ssh/id_rsa  # confirm public key not already present in cwd.
$ ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub # generate public key.
$ ssh-keygen -l -f ~/.ssh/id_rsa # confirm new public key matches existing private key.

configure client for multiple keys

~/.ssh/config

host foo.companyname.com
  addkeystoagent yes
  usekeychain yes
  identityfile ~/.ssh/firstname-lastname_companyname

host *
  addkeystoagent yes
  usekeychain yes
  identityfile ~/.ssh/default-keyname
  identitiesonly yes

note: if you're on macos and want to use the keychain to store your passphrase, you'll need something similar to the following in your ssh config:

host *
  UseKeychain yes

configure local ssh agent

note: be sure that the key is added/configured in the ~/.ssh/config file!

start the ssh agent

  • bash: $ eval "$(ssh-agent -s)"
  • powershell (needs admin rights): 
    > Set-Service -Name ssh-agent -StartupType Automatic
> Start-Service ssh-agent

add key to ssh agent

$ ssh-add -k ~/.ssh/whatever-key-you-want

remote keys

create list of authorized keys

 $ touch ~/.ssh/authorized_keys

append new key to list of authorized keys

 # after scp'ing key and changing key file permissions.
 $ cat ~/key.pub >> ~/.ssh/authorized_keys
 $ rm -f ~/key.pub