SSH/Keys

SSH can utilize public key encryption to authenticate and authorize users. This can be considered more secure especially if you secure your private key with a pass-phrase. The keys themselves are not susceptible to brute force attacks like normal passwords over SSH are.

Create and store the key pair

The first step is to generate a key which will create two files filled with long strings of characters. A public key file that you may distribute to any machine you want to use it on and a private key that needs to be kept secure. Allowing anyone to read this private key will compromise the security of the key and could allow someone to access any resources secured by this key without your consent.

There are a number of different key types but rsa is the most compatible. You can run the command ssh-keygen -t rsa to generate the new public and private key. It will prompt you for a file to create the private key and then for the public key append .pub extension and store it in the same directory. Pressing enter at the passphrase step twice will create a key without a pass-phrase.

-bash-4.2$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/derek/.ssh/id_rsa):
Created directory '/home/derek/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/derek/.ssh/id_rsa.
Your public key has been saved in /home/derek/.ssh/id_rsa.pub.
The key fingerprint is:
32:bf:db:74:1b:7e:d7:c6:4b:b5:6f:a8:82:55:3f:bf derek@localhost.localdomain
The key's randomart image is:
+--[ RSA 2048]----+
|                 |
|                 |
|                 |
|            .    |
|      o S  . .  .|
|       +  .   o o|
|        .o. o  B.|
|        .+.o o+ O|
|        o...+o E+|
+-----------------+

Copy the public key

Once you have a generated a key pair you will want to add it to one or more computers to allow you to access them. This can be done with the ssh-copy-id command and it will prompt you the first time for your current password (NOT your pass-phrase). You can replace localhost with any other hostname you want to copy the key to. You can also specify a alternate user or identity file if you need to, please man ssh-copy-id for more information within your terminal. This command will ensure that not only it copies your key but secures the file so that no one can tamper and add additional authorized keys to the file on the remote host.

-bash-4.2$ ssh-copy-id localhost
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
derek@localhost's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'localhost'"
and check to make sure that only the key(s) you wanted were added.

Batch clusters

Our Torque clusters process jobs in batch and require the ability to ssh without entering a password. You can simplify the existing example above by telling it you do not want a pass-phrase and can run the command ssh-keygen -t rsa -N "".

-bash-4.2$ ssh-keygen -t rsa -N ""
Generating public/private rsa key pair.
Enter file in which to save the key (/home/derek/.ssh/id_rsa):
Created directory '/home/derek/.ssh'.
Your identification has been saved in /home/derek/.ssh/id_rsa.
Your public key has been saved in /home/derek/.ssh/id_rsa.pub.
The key fingerprint is:
ff:7a:99:28:fc:63:d6:10:44:4c:2e:68:76:44:76:7a derek@localhost.localdomain
The key's randomart image is:
+--[ RSA 2048]----+
|       .+++      |
|       + +o      |
|      + +.E      |
|     o . o.      |
|        S  .     |
|         ..      |
|       .  .+ o   |
|        o =.=    |
|         =o+.    |
+-----------------+

After creating this key pair please make sure you follow the copy the public key instructions above to localhost. This will ensure that your key will be useable on all the cluster nodes since they have a shared home directory.

SSH Agents

While it is very useful to protect your SSH key pair with a pass-phrase it can very time consuming to re-type the pass-phrase over and over. SSH provides a agent that runs in the background and allow you add a key(s) to it with a time limit that they will be unlocked for.

You will need to specify a shell in this case bash but could be any shell as appropriate (tcsh, sh, etc). The time specified by -t is specified in seconds.

bash-4.2$ ssh-agent bash
bash-4.2$ ssh-add -t 1800
Enter passphrase for /home/derek/.ssh/id_rsa:
Identity added: /home/derek/.ssh/id_rsa (/home/derek/.ssh/id_rsa)
Lifetime set to 1800 seconds

You will be prompted for your passphrase and, when entered correctly, you will be able to ssh without entering a password. You can check what keys are load when you are running inside a ssh-agent by using the command ssh-add -l.

bash-4.2$ ssh-add -l
2048 ee:83:10:c8:2f:2c:17:5e:ef:80:42:7e:ff:75:9e:53 /home/derek/.ssh/id_rsa (RSA)