<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">\documentclass[onecolumn,letterpaper,11pt]{article}

%===================================================================
\input{common_latex/common_latex_packages}
\input{common_latex/common_latex_definitions}
\input{common_latex/common_latex_help_format}
%===================================================================

\begin{document}

\begin{labcover}
\labtitle{Help Topic: SSH Keys}
\vspace{0.1in}
\labdate{Spring 2020}
\vspace{0.1in}
\labauth{Michael Benjamin, mikerb@mit.edu}
\labauth{Department of Mechanical Engineering}
\labauth{MIT, Cambridge MA 02139}
\labline
\end{labcover}

\wikidoc{file=Help.SSHKeys}
\wikidoc{auth=mikerb@mit.edu}

%====================================================================
\section*{SSH Keys}
%====================================================================

Normally when using the secure shell utility, \cmd{ssh}, you will be
prompted for your password on each interaction. While secure, this can
cumbersome if such events are more frequent than say once per half
hour.  Certain tools, like SVN, use \cmd{ssh} as underlying utility to
handle authentication. This can also lead frequent entry of your
password, perhaps several times within a minute, depending on your
task.

\pskip

The \cmd{ssh} utility supports something called {\em ssh keys} to help
reduce the need for frequent entry of your password, while maintaining
the security of user authentication. It works by generating a public
and private key pair, with one part of the pair stored on your target
machine, and one part stored on your local machine. You authenticate on
your local machine once, and the following ssh interactions use this
key pair for authentication thereafter. This setup needs to be done once
for each machine you intend to interact with regularly.

\pskip
\noindent
Let's get started.

%---------------------------------------------------------------------
\subsection*{Generating and Key Pair}

The first step is to generate a public-private key pair. On your local
machine:

\vspace{0.15in}
\begin{consoleverb}
 $ ssh-keygen -t rsa -f ~/.ssh/id_rsa
\end{consoleverb}
\vspace{0.15in}

\noindent
You will be prompted (twice) for a passphrase. Choose this with the
same care you would for new password for yourself.

\pskip

\noindent
This will create a directory locally, if you don't already have it, in
your home directory called \var{.ssh/}. Like all hidden files or
directories, you need to use the \cmd{-a} option, \cmd{ls -a}, to see
the directory. The \cmd{-f ~/.ssh/id\_rsa} option explicitly names the
directory and filename of the private key. If you left this unspecified,
you may be prompted for the file name, with \var{id\_rsa} being the
default value anyway. Afterwards, things should look like:

\vspace{0.15in}
\begin{consoleverb}
 $ cd ~/.ssh
 $ ls
 id_rsa  id_rsa.pub
\end{consoleverb}
\vspace{0.15in}

\noindent
In the next step we will move the public key file, \var{id\_rsa.pub}
to the target machine. The private key file, \var{id\_rsa}, will remain
on your local machine.


%---------------------------------------------------------------------
\subsection*{Moving the Public Key to the Target Machine}

The next step is to move public half of the key pair to the target
machine. For most of us in the lab, the target machine is typically
the oceanai server, but it can also include any or all of the robots.

\pskip

The first step is to log on to the target machine and create a \cmd{.ssh/} directory in your home directory, if it doesn't already exist.
(\cmd{cd; mkdir .ssh}). It may be there already if you've ever invoked
\cmd{ssh} from your target machine account. This directory needs to
exist before the next step, which puts the public key file there. Now
that the target {\em location} exists, you're ready for the next step.
The next step is to copy the public key to the target machine. For
example, back on your local machine, using the username \var{joe}:

\vspace{0.15in}
\begin{consoleverb}
 $ scp ~/.ssh/id_rsa.pub joe@oceanai.mit.edu:~/.ssh/authorized_keys
\end{consoleverb}
\vspace{0.15in}

\noindent
Note this file on the target machine, \var{authorized\_keys}, contains
initially one public key, looking something like:

\vspace{0.15in}
\begin{fileverb}
 ssh-rsa AAAADSDFB3NzaC1SDFkc3FMAFSDFSDFAACBAIr857SDFSDFeJ27zYZsdfs+MLemsdfsn
 tHZv14dSHH14ynlLgDBVTafMA+DxPsdfsdfssdfwFezsUV/PmsdfsTasLdfLsEfgJgs2dfAsGdf7
 sdfsdfwsdrfPsdfDstfIsqfja/PKJKJKJ+mG7MD3+44sdxEsdHzsdflsdfUFFDWELFASDFDSSFSK
 JTYHFHFfsdfswKspdxewrfekYGAHTJu7XpXeFOTAjlkB5vRTMUC7   joe@joes_home_machine
\end{fileverb}
\vspace{0.15in}

\noindent
This sets up access for one particular username@machine. This file on
the target machine may also support different users, or different
machines, or both. Each user/machine will have a separate line in
the \var{authorized\_keys} file.

\subsection*{Things to Note if Setting Up Access for Multiple Machines}

IMPORTANT: If you are setting up access for more than one
user/machine, beware that when you execute the \cmd{scp} command above
that you will {\em overwrite} the \var{authorized\_keys} file. Instead
you should \cmd{scp} the \var{id\_rsa.pub} file to a temporary file of
a different name. For example:

\vspace{0.15in}
\begin{consoleverb}
 $ scp ~/.ssh/id_rsa.pub joe@oceanai.mit.edu:~/.ssh/authorized_keys_tmp
\end{consoleverb}
\vspace{0.15in}

\noindent
After this, you will need to log on to the target machine and then append
the temporary file (presumably with only one line) onto the existing
\var{authorized\_keys} file.

\vspace{0.15in}
\begin{consoleverb}
 (on the target machine)
 $ cd .ssh/
 $ ls
 authorized_keys  authorized_keys_tmp
 $ cat authorized_keys_tmp &gt;&gt; authorized_keys
 $ ls 
 authorized_keys  authorized_keys_tmp
 $ rm -f authorized_keys_tmp
 $ ls 
 authorized_keys
\end{consoleverb}
\vspace{0.15in}

\noindent
When all is done you can remove the \var{is\_rsa.pub} file on your local
machine.


%---------------------------------------------------------------------
\subsection*{Security - Configuring ssh keys to Expire}

Some people don't like the idea that, once the ssh key password has
been entered locally, it it remains valid indefinitely. What if
someone gained access to your computer somehow? Couldn't they then
also do further damage by logging into additional computer accounts of
yours, using your ssh key previously authenticated? If this scenario
haunts you, but you still want the conveniences of ssh keys, consider
having them expire after a duration of time to your liking. After all,
most interactions with remote machines, for say version control for example,
happen in bunches. So even if you set your ssh keys to expire after five
minutes, it could still save you from typing your password many
times. Plus, five minutes is an awefully short time for a thief to
figure out what to do with your computer. Personally I choose a timeframe
of something like two hours. 

\vspace{0.1in}
\noindent
The below instructions are for MacOS.  The first step is to edit the
following file:

\vspace{0.15in}
\begin{fileverb}
 /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist
\end{fileverb}
\vspace{0.15in}

\noindent
Look for the block of text looking like:

\vspace{0.15in}
\begin{fileverb}
&lt;key&gt;ProgramArguments&lt;/key&gt;
&lt;array&gt;
    &lt;string&gt;/usr/bin/ssh-agent&lt;/string&gt;
    &lt;string&gt;-l&lt;/string&gt;
&lt;/array&gt;
\end{fileverb}
\vspace{0.15in}

\noindent
Add the below indicated two lines, using whatever interval of time you choose.
The below duration is 30 minutes (\var{30m}), you can also enter this in seconds
hours, or days (\var{120s}, or \var{8h}, or \var{5d}).

\vspace{0.15in}
\begin{fileverb}
&lt;key&gt;ProgramArguments&lt;/key&gt;
&lt;array&gt;
    &lt;string&gt;/usr/bin/ssh-agent&lt;/string&gt;
    &lt;string&gt;-l&lt;/string&gt;
    &lt;string&gt;-t&lt;/string&gt;                        &lt;-- add this line
    &lt;string&gt;30m&lt;/string&gt;                       &lt;-- and this line
&lt;/array&gt;
\end{fileverb}
\vspace{0.15in}

\noindent
Then reboot. There may be ways around this, but apparently this is easiest.

\vspace{0.15in}
\noindent
The above tip is from Stack Exchange:

\noindent
\urlx{http://apple.stackexchange.com/questions/118223/}


%---------------------------------------------------------------------
\subsection*{Controlling SSH Key Expiration from the Command Line}

On MacOS, typically you will be prompted with a pop-up dialog window
prompting you for your ssh key password if it has not been set. This
occurs automatically if you invoke \cmd{ssh}, or a command
like \cmd{svn} that uses ssh. You can also "load your identity" from
the command line using the \cmd{ssh-add} command. This command can
also be used to delete your identity, or control the expiration time
of your identity. 

\vspace{0.1in}
\noindent
For example, if you don't want to wait for your identity to time-out,
you can do the following:

\vspace{0.15in}
\begin{consoleverb}
 $ ssh-add -d              &lt;-- deletes your ssh key identiy now
\end{consoleverb}
\vspace{0.15in}

\noindent
You can also add your ssh key (add your identity) from the command line
instead of waiting for the pop-up window prompt. By using the \var{-t}
option you can specify the timeout (in seconds) from the command line:

\vspace{0.15in}
\begin{consoleverb}
 $ ssh-add -t 1800          &lt;-- identity will time out in 1/2 hour
\end{consoleverb}
\vspace{0.15in}

\noindent
So if you normally have your identity never time out, or only after a
very long time, and you want to change it temorarily, try the below:

\vspace{0.15in}
\begin{consoleverb}
 $ ssh-add -d
 $ ssh-add -t 1800          
\end{consoleverb}
\vspace{0.15in}

\noindent
Run \cmd{ssh-add -h} to see more options for this command.

\end{document}



</pre></body></html>