Generating and Using SSH Keys
As admins, we often have to SSH into computers and/or servers. The default way of doing this is by typing user@servername into Terminal, and then entering the user’s password. Simple enough.
Now, what if I told you there was a way to SSH into a server without entering passwords? This is done by generating RSA keys, which are much more secure than simple passwords. If you’re interested in how RSA works, read this article by Jeronimo Garcia.
Note: Everything below was done on macOS. If you’re looking at doing this on non-macOS computers, the instructions will mostly work, but you’ll need to change a few things like directory paths, etc…
Step one: Generate a keypair
In Terminal on your local computer, type ssh-keygen -t rsa -b 4096.
This will generate a 4096 bit RSA key as opposed to the smaller, less secure 2048 bit RSA key. Because security!
I strongly recommend giving your keys unique names (the default names are “id_rsa” and “id_rsa.pub”), especially if you’ll be generating keypairs for multiple servers. So for “Enter file in which to save the key”, type /Users/your_username/.ssh/id_rsa_servername.
This will save a public and private key named “id_rsa_servername” and “id_rsa_servername.pub” in the ~/your_username/.ssh directory.
Before we continue, let’s talk about these two keys. “id_rsa_servername.pub” is your public key. This is the key that you’ll be putting on the server. “id_rsa_servername” is your private key. It’s extremely important that you never copy/share it. This key will remain on your local computer.
Step two: Copy the public key to the server
SSH into your server and navigate to ~/.ssh. Now we’ll need to create a file named “authorized_keys” (if it doesn’t already exist). This is where we’ll put the contents of our “id_rsa_servername.pub” key.
To create the file, type touch authorized_keys && chmod 700 authorized_keys.
touch authorized_keys will create a file named “authorized_keys”, and chmod 700 authorized_keys will change the file’s permissions so that it can only be read, modified, and executed by the user.
Back on your local computer and in the ~/.ssh directory, type cat id_rsa_servername.pub | pbcopy to copy the contents of “id_rsa_servername.pub” to your clipboard.
On the server, type nano authorized_keys to edit the file, hit command + v to paste your clipboard, and finally save the file by hitting control + x and then y to confirm.
Step three: Modify the config file
The last step is to edit the SSH config file on your local computer.
In the ~/.ssh directory, type nano config, and then enter the following: Host servername User user IdentityFile "~/.ssh/id_rsa_servername” Make sure you change “servername”, “user”, and “~/.ssh/id_rsa_servername”.
Save the file by hitting control + x and then y to confirm.
In Terminal, typing ssh servername should automatically get you into your server without prompting you for a password.
That’s it! Not only are SSH keys more secure than passwords, they also make SSH’ing into servers quicker.