SSH Authentication Keys setup

Feb 10, 2025 min read

Step 0: Create an ssh key pair.

Using ssh-keygen -t rsa -b 4096

Enter the name of the key, and a passphrase if pleased to [ Although, if passphrase is set, you need to enter it at every usage of this key]

Private key stays with you, and you will use it when accessing the server.

The public key is instated in the server’s .ssh folder.

Notes:

  1. The public key structure: <key-type> <base64-encoded-key> <optional-comment>
  2. The optional comment is auto added as username@host. Don’t panic if it’s specific to a host or a user, the key pair still works, and it’s just a comment.

-v verbose and -vv more verbose options are your best friends in analyzing the situation.

Step 1: Pre-requisites

  1. Ensure Open SSH/SSH agent is running.
  2. As mentioned above, private key is used from the client side in the connection and public key is used to check against the provided key at the server end.
    1. SSH has a permission requirement, the user should only have read-only permission and no one else should have any permission on the key files being used.
    2. So, in client side, we’ll lock down the private key and,
    3. on the server side, we should lock down the public key.

Step 2: Server side configuration:

  1. Once you have your public key at the server: [You can copy it from client, or generate them both in server and send both to client, whatever way works.]
  2. Place it in ~/.ssh folder and copy the public key file into authorized_keys file using cat your_public_key.pub >> authorized_keys
  3. Once that is done, check if /.ssh has the permissions as 700, if not chmod 700 ~/.ssh
  4. And ensure authorized_keys also has 600 for permissions, else, chmod 600 ~/.ssh/authorized_keys

Step 3: Client side configuration [This one is specific to Windows, but the process stays the same for linux as well]:

  1. Once you have your key pair at the client machine. [Same applies as mentioned in the server above.]

  2. Place them both in ~/.ssh folder.

  3. Create/edit file named ~/.ssh/config , update the contents as follows. Replace as required.

    	Host *.cs.purdue.edu # * is the wild card, it resolves for all the subdomains of cs.purdue.edu
										 # For example, the rule is resolved for pete12@mc18.cs.purdue.edu
		User pete12      # the username which you'd authenticate to the server.
		IdentityFile C:\Users\pete\.ssh\cs_purdue_ssh_key # The private key location

# --- OR ---

Host mcxx.cs.purdue.edu
		HostName mcxx.cs.purdue.edu    # If wanted to target a specific host name.
		User pete12
		IdentityFile C:\Users\pete\.ssh\cs_purdue_ssh_key

  4. Similar to the server side, make sure only the current user has permission to the .ssh directory and the private key’s readonly. Use the below commands to make sure it happens:

icacls C:\Users\pete\.ssh\id_rsa /inheritance:r icacls C:\Users\pete\.ssh\id_rsa /grant:r YourUser:(R,W)

You can also make sure this is the permissions structure:

!image.png

Tested and verified by past me.

  1. That’s it, verify if it works. If not, as said already. -v and -vv are your best friends.