Setting up Public Key Authentication with SSH

Public key authentication allows you to connect to a remote host without having to type your password. You still have to type a password access the local key, unless you specify no password (don't do this,) or use a utility like SSH Agent (more on this later.)

On the remote server, logged in as root (or using sudo):
  1. Edit /etc/sshd_config (/etc/ssh/sshd_config,) replacing the line that says
    #PubkeyAuthentication no
    to
    PubkeyAuthentication yes
  2. Make sshd reread the configuration file by issuing the command:
    kill -HUP `cat /var/run/sshd.pid`
On the client (your desktop) in a terminal:
  1. Create a public key:
    ssh-keygen -t dsa
    This will create a 1024 bit DSA key pair for you. Use the default file. When prompted for the passphrase, make it something complicated that you can remember (like a combination of two 8 keystroke random passwords separated by some character — making it 17 random keystrokes.)
    Do not use a blank passphrase.
  2. Add you new public key to the authorized_keys on the server
    ssh remote_server < .ssh/id_dsa.pub 'cat >> .ssh/authorized_keys'
    This will prompt you for your password, just like it always has (this hasn't changed yet.)
  3. Now, test the new authentication method
    ssh remote_host
    This should now prompt you to enter the passphrase for id_dsa. Enter the passphrase that you created with ssh-keygen.

You should now be set up to use public key authentication. But what's the point, if still have to enter a password? Well, if you use SSH Agent, you can store your ssh password in your keychain (i.e. SSH Agent takes care of authenticating to your SSH key for you, using your login authentication.) You then get to use ssh securely without having to enter your password every time — and it even works with X11.