SSH public key authentication: Difference between revisions
m Minor edit for consistency in commands |
m indentation and style improvements |
||
| (3 intermediate revisions by 2 users not shown) | |||
| Line 24: | Line 24: | ||
To make the SSH client automatically use the key file, add a host entry to your per-user SSH configuration file: | To make the SSH client automatically use the key file, add a host entry to your per-user SSH configuration file: | ||
{{file|~/.ssh/config| | {{file|~/.ssh/config|nix| | ||
<nowiki> | <nowiki> | ||
Host another-machine | Host another-machine | ||
| Line 54: | Line 54: | ||
<syntaxhighlight lang="console"> | <syntaxhighlight lang="console"> | ||
$ ssh-add ~/.ssh/id_rsa | $ ssh-add ~/.ssh/id_rsa | ||
Enter passphrase for .ssh/id_rsa: | Enter passphrase for /home/user/.ssh/id_rsa: | ||
Identity added: .ssh/id_rsa (myaccounts@mymachine) | Identity added: /home/user/.ssh/id_rsa (myaccounts@mymachine) | ||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 62: | Line 62: | ||
== SSH server configuration == | == SSH server configuration == | ||
You can manage SSH authorized public keys declaratively by adding them | You can manage SSH authorized public keys declaratively by adding them to your system configuration: | ||
{{file|/etc/nixos/configuration.nix|nix| | {{file|/etc/nixos/configuration.nix|nix| | ||
<nowiki> | <nowiki> | ||
users.users."myUser".openssh.authorizedKeys.keys = [ | |||
"ssh-rsa AAAAB3Nz....6OWM= user" # content of authorized_keys file | |||
# note: ssh-copy-id will add user@your-machine after the public key | |||
# but we can remove the "@your-machine" part | |||
]; | |||
</nowiki> | </nowiki> | ||
}} | }} | ||
| Line 76: | Line 76: | ||
Alternatively, you can reference a custom file containing the authorized keys: | Alternatively, you can reference a custom file containing the authorized keys: | ||
{{file| | {{file||| | ||
<nowiki> | <nowiki> | ||
users.users."user".openssh.authorizedKeys.keyFiles = [ | |||
./ssh/authorized_keys | |||
]; | |||
</nowiki> | </nowiki> | ||
}} | |name=/etc/nixos/configuration.nix|lang=nix}} | ||
For additional configuration options, see the {{nixos:option|users.users.*.openssh}} module documentation. | For additional configuration options, see the {{nixos:option|users.users.*.openssh}} module documentation. | ||
| Line 92: | Line 92: | ||
{{file|/etc/nixos/configuration.nix|nix| | {{file|/etc/nixos/configuration.nix|nix| | ||
<nowiki> | <nowiki> | ||
services.openssh = { | |||
enable = true; | |||
# require public key authentication for better security | |||
settings.PasswordAuthentication = false; | |||
settings.KbdInteractiveAuthentication = false; | |||
}; | }; | ||
</nowiki> | </nowiki> | ||