SSH - Secure Shell

As long as SSH is made available on local machine, one can simply run SSH (On the Client) to logon to a remote machine (The Server) by providing the password. Sometimes it is necessary to bypass the password so that it is possible to run a program
directly across the network.

Secure Shell (SSH) is a secure replacement for telnet, rlogin, rsh, and rcp and more. It uses encryption to keep information that you send over the network from being seen by others. It also uses public and private keys to validate that the host and client machines are who they say they are.

22-Nov-2006

Access machines with SSH

SSH is just like using telnet, one needs to enter password as usual. Bypassing password checking with SSH is similar to RSH. The only difference is that one has to make the remote machine "known" to the server machine.

There are two methods to set up password bypass. (1) RSA/Host method: this method works for most users. (2) RSA/User method: for sites that has stricter access cotrol, try this method.

RSA/Host Authentication

The RSA/Host method is recommended if one needs to bypass password checking. It uses ~/.ssh/known_hosts file to authenticate the host and uses ~/.rhosts to authenticate the user.

   A. ~/.ssh/known_hosts  
   B. ~/.rhosts           

In most cases, setting these two files are enough to avoid
providing password interactively. In case this method does not work,
try the RSA/User authentication method in the later section.

A. Setting up ~/.ssh/known_hosts file

This step authenticates the client machine. Each server machine has a ~/.ssh/known_hosts file that list all the known host. To access a remote machine, login to that machine with any method that works, then run 'ssh' back to the client host to set up this file.

    from the remote machine
    $ ssh <client-machine> date
    Host key not found from the list of known hosts.
    Are you sure you want to continue connecting (yes/no)?
    yes

Answer 'yes' to add a host key to the ~/.ssh/know_hosts file on the remote machine. Without these host key, SSH request will be rejected.

B. Setting up ~/.rhosts file

This step authenticates the user. The ~/.rhosts file is the same as RSH's. Its format:

   <host address1> <uid1>
   <host address2> <uid2>
        ...

For example:

   morgan11.slac.stanford.edu   mark
   shire01.slac.stanford.edu    mark

[Note]: This step is optional, the default is providing the password with the keyboard.

To bypass the password prompt to facilitate commands such as ufsdump and mt, set up the ~/.rhosts on the remote machine (server). From now on the password will be bypassed when you run 'ssh' from that remote machine to the target machine.

RSA/User Authentication

Some sites may disable the lower range ports thus disable the RSA/Host authentication. The symptom is that even though one set up the ~/.rhost and ~/.ssh/known_hosts, he is still asked for the password. When this is the case, one can try RSA/User authentication instead.

Protocol 1:                   [not recommended for connection via SSH]
   From client                            [where one runs ssh]
   $ ssh-keygen -t rsa1		         [create public key ~/.ssh/identity.pub]
   $ scp ~/.ssh/identify.pub <server>:~   [copy public key to server]
   From server          
   $ cat ~/identity.pub >> .ssh/authorized_keys
   From client          
   $ ssh-agent csh       [start a new session with agent]
     > ssh-add        [add .ssh/identity to ssh-agent]
     > ssh <server> date    			   [test it]

Protocol 2:                  [recommended for connection via SSH]
   From client          		[where one runs ssh]
   $ ssh-keygen -t rsa     	    [create public key ~/.ssh/id_rsa.pub]
   $ scp ~/.ssh/id_rsa.pub <server>:~   [copy public key to server]
   From server          
   $ cat ~/id_rsa.pub >> .ssh/authorized_keys  [append key to server]
   From client          
   $ ssh-agent csh       [start a new session with agent]
     > ssh-add        [add .ssh/identity to ssh-agent]
     > ssh -2 <server> date    			   [test it]

sshd is very fussy about file permissions. sshd insists on keeping the list of
where someone can log in from a secret and the permissions need to be set as follows:
     chmod 700 ~/.ssh
    chmod 600 ~/.ssh/authorized_keys

RSA/User Authentication Protocol 1

1. Creating RSA keys with ssh-keygen

    logon to client machine      [where one runs ssh]
    ssh-keygen -t rsa1     		[create keys]

Logon to the client machine and run ssh-keygen to create pair of RSA keys. When prompted for a passphrase, select one that is hard to guess. The public key will be created in ~/.ssh/identity.pub, the private key will be created in ~/.ssh/identity.

2. Copy public keys to server

    logon to the server machine
    emacs ~/.ssh/authorized_keys   [add keys]

Logon to the server machine and add the public keys from client machine's ~/.ssh/identity.pub to server machine's ~/.ssh/authorized_keys. The list of public keys stored in this file will enable server to grant connection request from the client.

3. Run ssh-agent to control private keys

    from the client machine     [where one runs ssh]
    ssh-agent bash          [run bash under ssh-agent]

From the client machine, type ssh-agent csh to create a csh session. One can also replace 'bash' with tcsh, csh, startx, xterm, etc. The purpose of running ssh-agent is to avoid typing the passphrase interactively. Ssh-agent provides keys automatically.

One should then run ssh from these window/process that were spawned with ssh-agent to take advantage of the auto-supply of the private keys. The ssh-agent is not running as separate process, each user must create his own window/process under his own ssh-agent.

4. Add keys to agent with ssh-add

    from the client machine     [where one runs ssh]
    ssh-add             [add .ssh/identity to agent]

From the process under ssh-agent on the client machine, type ssh-add to copy ~/.ssh/identity to ssh agent. One can also type 'ssh-add -l' to display the private keys in the agent or 'ssh-add -d <file>' to delete keys from the agent.

Once the private key of a client machine is held by the agent, the interactive passphrase dialog will be bypassed.

RSA/User Authentication Protocol 2

1. Creating RSA keys with ssh-keygen

    logon to client machine      [where one runs ssh]
    ssh-keygen -t rsa             		[create keys]

Logon to the client machine and run ssh-keygen to create pair of RSA keys. When prompted for a passphrase, select one that is hard to guess. The public key will be created in ~/.ssh/id_rsa.pub, the private key will be created in ~/.ssh/id_rsa.

2. Copy public keys to server

    logon to the server machine
    emacs ~/.ssh/authorized_keys   [add keys]
or
    cat ~/.ssh/id_rsa.pub | ssh user@machine "cat - >>.ssh/authorized_keys"

Logon to the server machine and add the public keys from client machine's ~/.ssh/id_rsa.pub to server machine's ~/.ssh/authorized_keys. The list of public keys stored in this file will enable server to grant connection request from the client.

3. Run ssh-agent to control private keys

    from the client machine     [where one runs ssh]
    ssh-agent basg          [run bash under ssh-agent]

From the client machine, type ssh-agent csh to create a csh session. One can also replace 'csh' with tcsh, startx, xterm, etc. The purpose of running ssh-agent is to avoid typing the passphrase interactively. Ssh-agent provides keys automatically.

4. Add keys to agent with ssh-add

    from the client machine     [where one runs ssh]
    ssh-add             [add .ssh/identity to agent]

From the process under ssh-agent on the client machine, type ssh-add to copy ~/.ssh/id_rsa to ssh agent. One can also type 'ssh-add -l' to display the private keys in the agent or 'ssh-add -d <file>' to delete keys from the agent.

Once the private key of a client machine is held by the agent, the interactive passphrase dialog will be bypassed. Use 'ssh -2' to activate the SSH authentication protocol 2.

SSH - Secure Shell

Contents:

A. Setting up ~/.ssh/known_hosts file

B. Setting up ~/.rhosts file