Risks

• If someone else has 'root' access on a computer containing your keys then they have access to your keys. If those people are your organisation's UNIX sysadmins then they may have access to everything anyway. If they don't, or if people other than trusted sysadmins have root access, then be very aware of the risk.

• Note that even if you do something clever like "mount your ssh keys temporarily from a network drive or USB device, add them to you ssh-agent, then unmount the ssh keys", someone with root can still steal your private key from the running ssh-agent process. Make sure you kill the agent whenever you logout (see the "SSH Forwarding/Tunnelling (Linux)" section later on this page). You should consider the feasibility of using the -t option of ssh-add to keep the key in the agent only long enough to establish your connection.

Install

On Linux ssh is shipped in two packages. openssh-server installs the daemon (sshd) and openssh-client installs the client (ssh). There is a third package that gets automatically installed: openssh-sftp-server.

Usage

SSH Forwarding/Tunnelling (Linux)

The ssh-agent tends to be already running for Ubuntu sessions. If it is not running, start it using...

eval $(ssh-agent)

To avoid starting a new process every time you connect, you should also add this (which will kill ssh-agent at logout)...

trap 'test -n "$SSH_AGENT_PID" && eval $(/usr/bin/ssh-agent -k)' 0

Identify your key...

ssh-add -L

Add this key to ~/.ssh/authorized_keys on all hosts, including any Bastion (jump-box) server, that you will access.

To delete the identity from the agent after 60 seconds...

ssh-add -t 60

To delete all identities from the agent...

ssh-add -D

You should now be able to connect directly to any of the servers using the variables containing the IP addresses or the IP addresses themselves...

ssh username@${JumpIP}

ssh username@${TargetIP[0]}

ssh username@${TargetIP[1]}

Port Forwarding

TODO

ssh -L

ssh -R

Configuration

All configuration is held under the .ssh subdirectory of the home directory of each user. e.g.

/home/oracle/.ssh

Private/Public Key File

/home/oracle/.ssh/id_rsa

/home/oracle/.ssh/id_rsa.pub

If you need to generate a private key/public key pair (where mykey.pem will be the file containing the private key):

ssh-keygen -t rsa -b 3072 -f mykey.pem

To generate the public key file from an existing private key file...

ssh-keygen -y -f mykey.pem > $HOME/.ssh/mykey.pub

authorized_keys

/home/oracle/.ssh/authorized_keys

If a key entry in the authorized_keys file on a serverA matches the public key of serverB then you can ssh to serverA from serverB without entering a password.

On Linux you can add keys to a remote authorized_keys file using this command (it does not work on AIX)...

ssh-copy-id -i ~/.ssh/id_rsa.pub user@serverA

known_hosts

/home/oracle/.ssh/known_hosts

Whenever you connect to a host using ssh, a checksum gets added to the known_hosts file under the .ssh directory in the users home directory. If the checksum ever changes, ssh will give you a warning when you try to connect.

config

For a specific user...

/home/oracle/.ssh/config

Config inherited by all users...

/etc/ssh/ssh_config

Use this file for overriding command line defaults and for configuration where there is no command line option. For example, this line in the config file...

VisualHostKey=yes

... is the same as this option on the command line...

ssh -o VisualHostKey=yes hostname

To make it easier to login to a host with an alternate user and ssh key, use something like this in you config file...

Host myserver

     User myuser

     IdentityFile ~/.ssh/mykey.pem

Passphrase

Having a passphrase makes the use of ssh more secure but can cause issues if you want to run automated scripts that connect to other servers without intervention. To remove/set a passphrase use...

ssh-keygen -p

Windows SSH

Troubleshooting

Bibliography