How-to: Setting up ssh keys

Summary:
For many people, ssh is the program that you were told to use instead of telnet. As such, many use ssh to login to other machines in the standard "enter username"/"enter password" manner.

But as it turns out, there are easier (and more secure) ways of logging into something remotely, yet still using ssh. For people that really care, ssh-agents are the way to go. However, there's an easy way to set yourself up such that you don't bother with agents, but you still don't ever need type in your password. (to machines you are regularly connecting to)

This is specifically targeted towards those that operate in an NFS/AFS type setup, where the user's home directory is on a network filespace, and you are regularly connecting to multiple machines within this network. A good example is the student needing to run experiments on multiple nodes of a cluster, quite frequently, and would appreciate not having to type in passwords each and every time s/he goes from node to node.

Note, this document contains virtually no technical information on ssh itself. For that the reader is directed to read the man pages for: ssh, sshd, ssh-agent, ssh-keygen. This here is a rough and ready, go go go sort of how-to.

Step 1: Setting up keys

note: ssh-keygen will ask you for a passphrase. If you are making a set of keys for bouncing around inside a trusted network, then just hit enter (blank passphrase). If you are are planning on using these keys for connecting to truely remote, untrusted machines, you should probably be using a passphrase.

% cd ~
% ssh-keygen -t dsa

This will create a public and private key-pair in your home directory under ~/.ssh

~/.ssh/id_dsa
~/.ssh/id_dsa.pub

Step 2: Copy public key

Since your home directory is shared between all the machines you will be connecting to (assuming you fit under the "who this was meant for" description), then your authorized_keys file will be the same locally as it is remote.

% cd .ssh/
% cat id_dsa.pub >> authorized_keys

Step 3: Set permissions

Unsurprisingly, ssh is really picky about permissions on files; we need to make sure things are setup just so. Most tutorials leave out this step, and the man pages are not very clear about it either. In my case I found it to be the difference between working and not working.

% chown username.group . *
% chmod 700 .
% chmod 600 *

Example for the first line:
% chown jshmoe.persons . *

Step 4: Test it

% ssh other.machine.on.network

Hopefully you should not have been prompted for a password.