One of OpenSSH’s great features is ssh public key authentication. For those of you who are as lazy as I am, and don’t want to type in and remember all kinds of different passwords for different hosts, it is the solution.
I’m not going to explain here what public key authentication is and why you would want to use it for increased security. If you want to know (and you should), just read Dave Aaldering’s SSH with Keys HOWTO. What I am going to explain, is how to get it to work seamlessly on Mac OS X.
First, I’m going to explain how to get the authentication to work in a client/server configuration. If you already know how to do this, and are just interested in the Mac OS X specific part, skip to the end :)
Key generation and exchange
Since Mac OS X is just like any other UNIX, this should be basic knowledge.
Generating keys for the client (your Mac)
client:~ user$ mkdir ~/.ssh # if it doesn't exist client:~ user$ chmod 700 ~/.ssh client:~ user$ ssh-keygen -q -f ~/.ssh/id_rsa -t rsa Enter passphrase (empty for no passphrase): … Enter same passphrase again: …
This will generate a public/private key pair. Needless to say, the private key (~/.ssh/id_rsa) should be kept private at all times, and the public key (~/.ssh/id_rsa.pub) is meant for distribution. Let’s do that right now.
Distributing the key to the server
In my example, the server is a Linux system. Any other UNIX running OpenSSH will do fine.
First, we copy the key from your Mac to the server using SCP:
client:~ user$ scp ~/.ssh/id_rsa.pub user@server.example.com:~
This will put the key in your homedir.
Next, we SSH to the server, and add our key to the list of authorized keys:
user@server:~$ mkdir ~/.ssh #if it doesn't exist user@server:~$ chmod 700 ~/.ssh user@server:~$ cat ~/id_rsa.pub >> ~/.ssh/authorized_keys user@server:~$ chmod 600 ~/.ssh/authorized_keys user@server:~$ rm ~/id_rsa.pub
Now we have basic public key authentication working. Test it by typing in (on the client):
client:~ user$ ssh -o PreferredAuthentications=publickey server.example.edu
You should be prompted for your passphrase and it should work :)
Integrating into Mac OS X
Having verified that the previous steps worked, we’ve created a situation where instead of all kinds of different passwords, you have to type in a generic passphrase for every new connection. While this certainly is a nice improvement, it still isn’t that easy to use.
Fortunately, Mac OS X already has a great feature for managing your keys: the keychain. The next step is to get this keychain to keep our SSH keys as well.
First, download and install SSHKeychain. This nifty little tool will act as a gateway to Mac OS X’s keychain.
Next, run SSHKeychain, and go into it’s preferences. In the “Environment” tab, check the “Manage (and modify) global environment variables” tickbox. This is required for ssh to be able to find the application later.
In the “SSH Keys” tab, ensure your Key Location is listed (/Users/yourname/.ssh/id_dsa).
For extra convenience, add SSHKeychain to your Login Items. Open “System Preferences”, go to “Accounts” and open the “Login Items” tab.
You will now have to re-login, to make the global variables work and have SSHKeychain popup every time you try to SSH to a server that has your public key!
As a final step, you can finetune Mac OS X’s keychain settings for extra security.
In het studentenhuis waar ik woon wordt het oud-papier van twaalf bewoners (op het moment trouwens maar 10) verzameld in een enorme doos, die in een grijs verleden dienst gedaan moet hebben als verpakkingsmateriaal van een flinke breedbeeldtelevisie. Heerlijk luxe natuurlijk, zo’n grote doos, maar ook wel erg verleidelijk. Het is namelijk wel erg makkelijk om altijd maar papier in die doos te gooien, maar hem maar mondjesmaat te legen als het oud-papier weer eens wordt opgehaald.
Altijd al eens afgevraagd of je een speeltje nu bij je kind in de mond moet stoppen, of het toch beter voor ‘s avonds in de slaapkamer kunt bewaren? Doe dan 