3 ms·

Still about ssh : "typing a password on your local machine once, then using a secure identity to login to several remote machines without having to retype your

by Kurtz79 13y ago

Still about ssh : "typing a password on your local machine once, then using a secure identity to login to several remote machines without having to retype your password by using an ssh key agent. This is awesome. " Sounds awesome, but I really didn't understand what he means. Is he talking about using a certificate (-i option) to log in ?

oftenwrong 13y ago
I am fairly sure they are referring to ssh-add
laumars 13y ago
Yeah, you have a cert set up and put the public cert in the identities file for each server you want to connect to. Then just SSH into each box with agent forwarding ('-a' I think, but you're best to check that). So you'll need to create an SSH cert first: ssh-keygen -b 4096 -t rsa -C "$USER created on $(hostname)" -f $USER.key Keep the private key, that's essential you keep this safe as it's literally your key to access any servers you do the next step for. On each server SSH, append your public key to the of /home/$USER/.ssh/authorized_keys (creating the file if it doesn't exist). It must be the public key! There'll be better guides online for this stuff so I suggest you have a read through them before blindly pasting the stuff I've posted into your terminal. But it's all quite simple stuff once you've grasped the difference between a public and private key (if you weren't already aware - you may well be)
- larrys 13y ago
  Keeping in mind that the ssh agent is root accessible on the machine in the /tmp directory looking something like this: "ssh-ebT23030" Meaning that anyone with root access who know the other machines that someone is accessing as well as their username can access those machines. I've seen cases where in abnormally terminated sessions that file stays around instead of getting deleted when the session ends.

3 ms·

Still about ssh : "typing a password on your local machine once, then using a secure identity to login to several remote machines without having to retype your

by Kurtz79 13y ago

oftenwrong 13y ago
I am fairly sure they are referring to ssh-add
laumars 13y ago
Yeah, you have a cert set up and put the public cert in the identities file for each server you want to connect to. Then just SSH into each box with agent forwarding ('-a' I think, but you're best to check that). So you'll need to create an SSH cert first: ssh-keygen -b 4096 -t rsa -C "$USER created on $(hostname)" -f $USER.key Keep the private key, that's essential you keep this safe as it's literally your key to access any servers you do the next step for. On each server SSH, append your public key to the of /home/$USER/.ssh/authorized_keys (creating the file if it doesn't exist). It must be the public key! There'll be better guides online for this stuff so I suggest you have a read through them before blindly pasting the stuff I've posted into your terminal. But it's all quite simple stuff once you've grasped the difference between a public and private key (if you weren't already aware - you may well be)
- larrys 13y ago
  Keeping in mind that the ssh agent is root accessible on the machine in the /tmp directory looking something like this: "ssh-ebT23030" Meaning that anyone with root access who know the other machines that someone is accessing as well as their username can access those machines. I've seen cases where in abnormally terminated sessions that file stays around instead of getting deleted when the session ends.