View source for SSH public key authentication

To setup a public key based SSH connection from <code>your-machine</code> (client) to <code>another-machine</code> (server):

<syntaxhighlight lang="console">
[user@your-machine] $ ssh-keygen -f ~/.ssh/another-machine
[user@your-machine] $ ssh-copy-id -i ~/.ssh/another-machine another-machine-host-or-ip
</syntaxhighlight>

In case <code>another-machine</code> uses another port for SSH connections use this command instead:
<syntaxhighlight lang="console">
[user@your-machine] $ ssh-copy-id -i ~/.ssh/another-machine -p1234 another-machine-host-or-ip
</syntaxhighlight>

Now the public key is stored on the <code>another-machine</code> in <code>/home/user/.ssh/authorized_keys</code>

On <code>your-machine</code>, we stored the key file in the non-standard path <code>~/.ssh/another-machine</code>, so we must tell the SSH client to use the key file:

<syntaxhighlight lang="console">
[user@clientmachine] $ ssh -i ~/.ssh/another-machine another-machine-host-or-ip
</syntaxhighlight>

The connection should work without password.

To make the SSH client automatically use the key file, we add this to <code>/home/user/.ssh/config</code>:

<syntaxhighlight>
Host another-machine
  HostName 192.168.1.105 # another-machine-host-or-ip
  #Port 22
  #User user

  # Prevent using ssh-agent or another keyfile, useful for testing
  IdentitiesOnly yes
  IdentityFile ~/.ssh/another-machine
</syntaxhighlight>

== SSH agent ==
A ssh private key, for which a phrase is defined, can be clumsy if you use it multiple times. It is possible to store the private key identity in a ssh-agent. The ssh-agent uses the ssh private key identity when you issue a ssh command, for instance when using ssh to connect.

To define NixOS to setup a ssh-agent, add this to your configuration:
<syntaxhighlight lang="nix">
programs.ssh.startAgent = true;
</syntaxhighlight>

NixOS will start a user systemd service with the ssh-agent at login. You can see the service with the command <code>systemctl --user status ssh-agent</code>.

It provides also the environment variable $SSH_AUTH_SOCK which refers to <code>/run/user/1000/ssh-agent</code> , in this case for user id 1000.

If you want to use a ssh key pair for authenticating, you can add this to the ssh-agent using the command ssh-add entering the phrase only once.

<syntaxhighlight lang="console">
[user@your-machine] $ ssh-add .ssh/id_rsa
Enter passphrase for .ssh/id_rsa: 
Identity added: .ssh/id_rsa (myaccounts@mymachine)
</syntaxhighlight>

If you store the ssh public key with the command ssh-copy-id on <code>another-machine</code> as shown above, you can logon without giving a password or phrase.

== SSH server config ==

Optionally, on the NixOS-based <code>another-machine</code>, we can set <code>passwordAuthentication = false;</code> to require public key authentication for better security.

<syntaxhighlight lang="nix">
services.openssh = {
  enable = true;
  # require public key authentication for better security
  settings.PasswordAuthentication = false;
  settings.KbdInteractiveAuthentication = false;
  #settings.PermitRootLogin = "yes";
};
</syntaxhighlight>

We can also store the public keys in <code>/etc/nixos/configuration.nix</code>:

<syntaxhighlight lang="nix">
users.users."user".openssh.authorizedKeys.keys = [
  "ssh-rsa AAAAB3Nz....6OWM= user" # content of authorized_keys file
  # note: ssh-copy-id will add user@your-machine after the public key
  # but we can remove the "@your-machine" part
];
</syntaxhighlight>

... or use a custom path for the <code>authorized_keys</code> file:

<syntaxhighlight lang="nix">
users.users."user".openssh.authorizedKeys.keyFiles = [
  /etc/nixos/ssh/authorized_keys
];
</syntaxhighlight>

== KDE ==

By default, KDE prompts you to enter the passwords for your SSH keys to unlock them across session starts. To avoid being asked to unlock your SSH keys every time a session is restarted (e.g., after logging out or rebooting), you can use <code>ksshaskpass</code> to store the passwords. To enable this, make the following changes to your configuration:

<syntaxhighlight lang="nix">
programs.ssh = {
  startAgent = true;
  enableAskPassword = true;
};

environment.variables = {
  SSH_ASKPASS_REQUIRE = "prefer";
};
</syntaxhighlight>

After applying these changes, either log out (if you used <code>switch</code>) or reboot (if you used <code>boot</code> for the variables to take effect.

When you use an SSH key for the first time, you will be prompted to enter its passphrase. <strong><em>Be sure to select the "Remember password" checkbox</strong></em> and the passphrase will be securely stored in the KDE Wallet and automatically retrieved across session restarts.

== See also ==

* [[Distributed build]]