Public key authentication allows you to connect to a remote host without having to type
your password. You still have to type a password access the local key, unless you specify no
password (don't do this,) or use a utility like SSH Agent
(more on this later.)
On the remote server, logged in as root (or using sudo):
- Edit /etc/sshd_config (/etc/ssh/sshd_config,) replacing the line that says
#PubkeyAuthentication no
to
PubkeyAuthentication yes
- Make sshd reread the configuration file by issuing the command:
kill -HUP `cat /var/run/sshd.pid`
On the client (your desktop) in a terminal:
- Create a public key:
ssh-keygen -t dsa
This will create a 1024 bit DSA key pair for you. Use the default file. When prompted for
the passphrase, make it something complicated that you can remember (like a combination of
two 8 keystroke random passwords separated by some character — making it 17 random keystrokes.)
Do not use a blank passphrase.
- Add you new public key to the authorized_keys on the server
ssh remote_server < .ssh/id_dsa.pub 'cat >> .ssh/authorized_keys'
This will prompt you for your password, just like it always has (this hasn't changed yet.)
- Now, test the new authentication method
ssh remote_host
This should now prompt you to enter the passphrase for id_dsa. Enter the passphrase that
you created with ssh-keygen.
You should now be set up to use public key authentication. But what's the point, if still
have to enter a password? Well, if you use SSH Agent,
you can store your ssh password in your keychain (i.e. SSH Agent
takes care of authenticating to your SSH key for you, using your login authentication.)
You then get to use ssh securely without having to enter your password every time — and it even works with X11.
Copyright © 2003 Jerry Talkington
The contents of these web pages are licensed under the
Open Software License version 1.1.
Any software hosted on this site is subject to the license that accompanies it.