Friday, November 8, 2013

Use SSH Keys (public key cryptography) to connect on your LAN

Learning by example: (and borrowing from the Arch wiki)

I want to connect to my desktop from my htpc.
Assuming that openssh is installed and the daemon is running, and that /etc/ssh/sshd_config is configured to your satisfaction.

Issue the following command to create a 521 bit long public/private ECDSA key pair with an extended comment on the HTCP.

htpc $ ssh-keygen -t ecdsa -b 521 -C "$(whoami)@$(hostname)-$(date -I)"

Authorized_keys file

In order to connect from the htpc, the desktop must have a copy of the htpc's public key in its ~/.ssh/authorized_key file. Use whatever method you have available to get a copy of the id_ecdsa.pub to the desktop.

desktop $ scp david@htpc:/home/david/.ssh/id_ecdsa.pub /home/david/tmp

Then import this public key into the ~/.ssh/authorized_keys file.

desktop $ cat ~/tmp/id_ecdsa.pub >> ~/.ssh/authorized_keys
desktop $ rm ~/tmp/id_ecdsa.pub


Known_hosts

Upon your first connection to the desktop, you will see the following

htpc $ ssh david@desktop
The authenticity of host 'desktop (192.168.1.110)' can't be established.
ECDSA key fingerprint is 61:3e:e6:40:29:d7:d8:dc:db:f8:0b:d9:74:c5:d6:6f.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'desktop,192.168.1.110' (ECDSA) to the list of known hosts.
Enter passphrase for key '/home/david/.ssh/id_ecdsa':

This creates an entry in /home/david/.ssh/known_hosts which will allow connections to desktop.