SSH public key authentication: Difference between revisions

From NixOS Wiki
imported>Milahu
No edit summary
imported>Milahu
No edit summary
Line 8: Line 8:
Now the public key is stored on the <code>servermachine</code> in <code>/home/user/.ssh/authorized_keys</code>
Now the public key is stored on the <code>servermachine</code> in <code>/home/user/.ssh/authorized_keys</code>


Note: On the <code>clientmachine</code>, we created the public key file in the non-standard path <code>~/.ssh/servermachine</code>, so later we must use <code>ssh -i ~/.ssh/servermachine servermachine</code> to send our public key.
On the <code>clientmachine</code>, we stored the key file in the non-standard path <code>~/.ssh/servermachine</code>, so we must tell the SSH client to use the key file:
 
Now we must tell the SSH client to send the public key:


<syntaxhighlight lang="console">
<syntaxhighlight lang="console">
Line 18: Line 16:
The connection should work without password.
The connection should work without password.


To make the SSH client automatically use the public key file, we add this to <code>/home/user/.ssh/config</code>:
To make the SSH client automatically use the key file, we add this to <code>/home/user/.ssh/config</code>:


<syntaxhighlight>
<syntaxhighlight>

Revision as of 12:04, 24 October 2021

To setup a public key based SSH connection from clientmachine to servermachine:

[user@clientmachine] $ ssh-keygen -f ~/.ssh/servermachine
[user@clientmachine] $ ssh-copy-id -i ~/.ssh/servermachine servermachine

Now the public key is stored on the servermachine in /home/user/.ssh/authorized_keys

On the clientmachine, we stored the key file in the non-standard path ~/.ssh/servermachine, so we must tell the SSH client to use the key file:

[user@clientmachine] $ ssh -i ~/.ssh/servermachine servermachine

The connection should work without password.

To make the SSH client automatically use the key file, we add this to /home/user/.ssh/config:

Host servermachine
  HostName 192.168.1.105
  #Port 22
  #User user

  # Prevent using ssh-agent or another keyfile, useful for testing
  IdentitiesOnly yes
  IdentityFile ~/.ssh/servermachine

SSH server config

Optionally, on the NixOS-based servermachine, we can set passwordAuthentication = false; to require public key authentication for better security.

services.openssh = {
  enable = true;
#  passwordAuthentication = false; # default true
#  permitRootLogin = "yes";
#  challengeResponseAuthentication = false;
};

We can also store the public keys in /etc/nixos/configuration.nix:

users.users."user".openssh.authorizedKeys.keys = [
  "ssh-rsa AAAAB3Nz....6OWM= user" # content of authorized_keys file
  # note: ssh-copy-id will add user@clientmachine after the public key
  # but we can remove the "@clientmachine" part
];

... or use a custom path for the authorized_keys file:

users.users."user".openssh.authorizedKeys.keyFiles = [
  /etc/nixos/ssh/authorized_keys
];

See also