Internal knowledge share on SSH setup and usage. Includes some helpful config file options to save time and how to create and use SSH keys for better security and productivity.

1. SSH Keys and Configurations
Chris Hales

2. What is SSH?
Secure Shell aka SSH is a secure encrypted communication protocol
designed to replace older insecure protocols like telnet, rsh, and ftp.

3. What is SSH?
Secure Shell aka SSH is a secure encrypted communication protocol
designed to replace older insecure protocols like telnet, rsh, and ftp.
SSH authentication can be done with a username and password
combination which is the default. Here's the most simplistic usage we might
encounter.
$ ssh user@secureserver
After you connect to secureserver you are normally asked for your
password to complete the login.

4. What is SSH?
Secure Shell aka SSH is a secure encrypted communication protocol
designed to replace older insecure protocols like telnet, rsh, and ftp.
SSH authentication can be done with a username and password
combination which is the default. Here's the most simplistic usage we might
encounter.
$ ssh user@secureserver
After you connect to secureserver you are normally asked for your
password to complete the login.
When you start doing this over and over again for many systems with
various paswords it can become pretty tedious. What if there was a way to
simplify the process?
Time for SSH Keys to save the day!

5. Enter SSH Keys!
SSH can be configured to use key pairs so that you don't have to type your
password in every time you need to log into a commonly accessed
system. Your public key is placed on all systems you wish to access using
your private key.

6. Enter SSH Keys!
SSH can be configured to use key pairs so that you don't have to type your
password in every time you need to log into a commonly accessed
system. Your public key is placed on all systems you wish to access using
your private key.
There's a lot of technical details surrounding public-key cryptography but for
our purposes all you really need to know is that it's a really secure way of
proving who you are to a third party system.
Let's begin with creating your key pair if you don't already have one. Mac
and Linux setup is basically identical. For Windows you will need Putty and
PuTTYgen installed.

7. Key Creation for Windows
For Windows users I'm cheating and sending you to an excellent
PuTTYgen how-to which includes key pair creation.
http://theillustratednetwork.mvps.org/Ssh/Private-publicKey.html

8. Key Creation for Mac/Linux
On unix like systems (Ubuntu, OSX, etc.) we'll need to go through a few
steps. Fortunately it's likely you already have an SSH directory because if
you have ever used SSH one was created for you.
Open up a terminal window and check your home directory for a hidden .
ssh directory.
$ cd ~/.ssh

9. Key Creation for Mac/Linux
On unix like systems (Ubuntu, OSX, etc.) we'll need to go through a few
steps. Fortunately it's likely you already have an SSH directory because if
you have ever used SSH one was created for you.
Open up a terminal window and check your home directory for a hidden .
ssh directory.
$ cd ~/.ssh
If you receive a "no such file or directory" type of error message you have
not used SSH and certainly don't have a key installed on your system.
Next we'll create a set of keys which will create the file structure we need
for us automatically.

10. Key Creation for Mac/Linux
When you create an SSH key pair you want to enter a strong passphrase
when prompted to do so*. While you could skip the passphrase it would
allow anyone who can access it the ability to use it. Your key is valuable
and it should be protected at all costs.

11. Key Creation for Mac/Linux
When you create an SSH key pair you want to enter a strong passphrase
when prompted to do so*. While you could skip the passphrase it would
allow anyone who can access it the ability to use it. Your key is valuable
and it should be protected at all costs.
Let's create a strong 2048 bit RSA key with your email address included.
$ ssh-keygen -t rsa -b 2048 -C"user@domain.com"
You will be asked for a few options and you can leave those as their
defaults but when asked for a passphrase choose a solid one.
* A common practice when using SSH keys is to omit a passphrase
because the default setup requires that you enter your passphrase each
time you use your key which is seemingly the same as typing a password at
login each time. Further in we'll cover how to work around this so you only
need to enter your passphrase once per session.

12. Key Creation for Mac/Linux
Once your key is created you should see some new files which
were indicated during your key generation.
$ cd ~/.ssh
$ ls
~/.ssh/id_rsa
This is your private key file that ssh will read by default when a login
attempt is made. You can have multiple keys, i.e. id_otherkey.
~/.ssh/id_rsa.pub
This is your public key file for authentication. The contents of this file should
be added to ~/.ssh/authorized_keys on all machines where you wish
to login using key authentication. There is no need to keep the contents of
this file secret.

13. Key Creation for Mac/Linux
To use your shiny new key on a server you need to copy your public key
over the the authorized_keys file. It's usually not safe to try to do a simple
copy/paste since even a stray return will break a key file and OSX doesn't
contain the ssh-copy-id utility so we'll have to do some magic.
$ ssh user@174.143.170.119 -p 7022 "umask 077;
cat >> .ssh/authorized_keys" < ~/.ssh/id_rsa.pub

14. Key Creation for Mac/Linux
To use your shiny new key on a server you need to copy your public key
over the the authorized_keys file. It's usually not safe to try to do a simple
copy/paste since even a stray return will break a key file and OSX doesn't
contain the ssh-copy-id utility so we'll have to do some magic.
$ ssh user@174.143.170.119 -p 7022 "umask 077;
cat >> .ssh/authorized_keys" < ~/.ssh/id_rsa.pub
Now you should be able to authenticate to the server with your key.
$ ssh user@174.143.170.119 -p 7022
If all is right in the world you will be asked for your key passphrase and not
your server password.

15. Key Creation for Mac/Linux
To use your shiny new key on a server you need to copy your public key
over the the authorized_keys file. It's usually not safe to try to do a simple
copy/paste since even a stray return will break a key file and OSX doesn't
contain the ssh-copy-id utility so we'll have to do some magic.
$ ssh user@174.143.170.119 -p 7022 "umask 077;
cat >> .ssh/authorized_keys" < ~/.ssh/id_rsa.pub
Now you should be able to authenticate to the server with your key.
$ ssh user@174.143.170.119 -p 7022
If all is right in the world you will be asked for your key passphrase and not
your server password.
Success! :)

16. Key Creation for Mac/Linux
To use your shiny new key on a server you need to copy your public key
over the the authorized_keys file. It's usually not safe to try to do a simple
copy/paste since even a stray return will break a key file and OSX doesn't
contain the ssh-copy-id utility so we'll have to do some magic.
$ ssh user@174.143.170.119 -p 7022 "umask 077;
cat >> .ssh/authorized_keys" < ~/.ssh/id_rsa.pub
Now you should be able to authenticate to the server with your key.
$ ssh user@174.143.170.119 -p 7022
If all is right in the world you will be asked for your key passphrase and not
your server password.
Success! :)
Failure :( contact Chris.

17. SSH Agent
Entering your passphrase on every login defeats the intent of using keys.
ssh-agent will take care of the pesky prompts. Under OSX it runs by default
so you will even get a popup asking you to save your passphrase to the
keychain. Once you save it you will never be asked again on your local
system.

18. SSH Agent
Entering your passphrase on every login defeats the intent of using keys.
ssh-agent will take care of the pesky prompts. Under OSX it runs by default
so you will even get a popup asking you to save your passphrase to the
keychain. Once you save it you will never be asked again on your local
system.
For Linux it's little more complex. You will need to add a script to your ~/.
profile file or you can execute a couple of short commands. The following
will start up the ssh-agent and then allow ssh-add to pickup on the variables
and it will hold your key for an entire session. Please note the back ticks
around ssh-agent.
$ eval `ssh-agent`
$ ssh-add
You will be prompted for your passphrase one time but not again
during the same session.

19. SSH Config
We've got new keys and we can access some servers with them. We're still
doing a lot of typing though. e.g.
$ ssh user@174.143.170.119 -p 7022
Wouldn't it be nice if we could convert that into a short simple easy to
remember command like the following?
$ ssh staging

20. SSH Config
We've got new keys and we can access some servers with them. We're still
doing a lot of typing though. e.g.
$ ssh user@174.143.170.119 -p 7022
Wouldn't it be nice if we could convert that into a short simple easy to
remember command like the following?
$ ssh staging
We can! Using a user configurable ssh config file you can create aliases for
commonly access systems. Just create a config file using your favorite
editor and adding it to your .ssh directory.
$ nano -w ~/.ssh/config
Host staging
User <your-username>
Hostname 174.143.170.119
Port 7022

21. SSH Config
There are a number of things you can do inside the ssh config file but
aliases/bookmarks are probably the most common entries you will run into
or need for yourself. Here's the basic entry for our staging example.
Host staging
User <your-username>
Hostname 174.143.170.119
Port 7022
This creates an alias to the 174.143.170.119 server with our user and port
options. The "Host" line is the alias name we assign. Now calling the
following will start an ssh session for ssh user@174.143.170.119 -p 7022.
$ ssh staging

22. The End
That's it. You are now an ssh wizard and can work both conveniently and
securely. Keep your keys safe but if they are ever lost or you suspect an
issue notify an admin quickly.
To be really useful you will want to add your current private key or create a
new key for staging. Because of permission issues however you may need
a hand setting things up correctly.