Pedro Assunção

SSH login without password (authorized_keys)

I know that a lot of people covered this in the past but, since I also use this blog as a vault for tips that I might forget in the future, here’s how to make ssh not require you to enter a password when connecting to another machine:

Step 1: Generate your public and private ssh keys on the client computer (the one you are accessing FROM):

• Run the ssh-agent command. This will print out a bunch of information like the SSH agent connect socket and process id. You don’t need to know any of it, thankfully
• Run the ssh-keygen command. It will ask you for a passphrase for your key file. According to the MAN documentation for ssh-keygen, host keys must have an empty passphrase, so just leave it blank (i.e. press enter twice) for no passphrase. Read the update below, about the passphrase.

Here’s an example of the commands and their output so far:

void@localhost:~$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-RAMZT14968/agent.14968; export SSH_AUTH_SOCK;
SSH_AGENT_PID=14969; export SSH_AGENT_PID;
echo Agent pid 14969;
void@localhost:/~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/void/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/void/.ssh/id_rsa.
Your public key has been saved in /home/void/.ssh/id_rsa.pub.
The key fingerprint is:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx void@localhost
The key's randomart image is:
+--[ RSA 2048]----+
|                 |
|   x   x         |
|    x   x        |
|     x x         |
|    . x xx       |
|     x x x       |
|    x x  x       |
|   xxx..         |
|   xxxxxx        |
+-----------------+

The key’s fingerprint and randomart image will be different, of course, but it’s not really that relevant anyways.

Step 2: Now, the previous command will generate a couple of files under /home/<your_username>/.ssh. They are the public and private key files. The one you are interested in is the public one. If you do a cat ~/.ssh/id_rsa.pub you will see something like this:

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuqjnglf3wVE0wlLf3VJBIGVN6oZiPARy0oyJnCYtjd2No+kvaExR60cC5f7EvqHPeKiyQd4VBxZixta5R0ilX6wxhNqmI/J1vbXrlZqwe4Iewjd9p0cMlu5qdEzeFs1ImDWbfRl8W5hv5jV4AelIMPYg3FeOnEPM21wQgZb12Z+C+So6mFsHmxtz7b33JyqFXE45t0qscJwPYVBkYAFJFvO20ZgtqUer7/AnSEN+p3gP0ATbIzROR4r3C1gtqykIpQmdTKkbZWWP3OOAwDuLfyMYwNir8FFK7/VALPH2pb79ogaiEMNB71teoktXshiM1/h1shdwtXZcBAjweUgj6w== void@localhost

Step 3: This is your public key. Copy this string into a file called ~/.ssh/authorized_keys in the machine you want to connect to. The file might or not exist. If it doesn’t, create it and add that line to it. If it already exists, just append that line to the rest of the others in there (if any). Those are just keys of other people that also accesses the machine.

Step 4: Log out of the target machine and try to ssh again. It should no longer ask you for a password

UPDATE: As a lot of people pointed out some things that were wrong/poorly explained, here’s an update:

• There is a nicer way of doing all of this:
  • Use ssh-keygen to generate the key
  • Use a very handy script (available in most distributions) to copy the key and append it to authorized_keys automatically: ssh-copy-id user@host. If you are running sshd in a different port you can do it like so: ssh-copy-id ‘user@host -p1337′
  • In case your OS does not have this script, you can get it here.
• Always use a passphrase when generating the key. Read this comment thread for more info.
• A lot of newer systems prefer SSH2. On key generation do ssh-keygen -t dsa. The only (superficial) difference is that the public key will be called id_dsa.pub, instead of id_rsa.pub. Actually SSH2 already supports RSA, so ignore that and go with the default . Apparently there are some reasons why you would want to go with RSA (default) in the first place.
  
• In order for not having to enter your passphrase every time you connect, make sure the ssh-agent is running and do an ssh-add to add your key to it. That way you don’t need to enter your passphrase anymore for the duration of that session.
• For a more in-depth article on SSH, check this out.

Related:

1. Java Web Start (jnlp) simple example One of my current projects requires me to deliver a...
2. Android location provider mock So, yeah, I resumed playing around with android, this time...

Tagged with:

Categorised as: computers, software development, tips