Thursday, September 29, 2011

creating ssh keys for your users

User level: newbie

This is how to create ssh keys to all your users with "you" the one creating them in your account.

The reason I created this post is to make it clear that one user can create ssh keys to everyone.

This post was made possible by happy coders blog post SSH public key authentication (a.k.a "passwordless login") and svn+ssh: one ssh account, multiple subversion users.

To start:
create a keypair
$ ssh-keygen -t rsa -C "john@yourcompany.com"

Do not enter a passphrase. Creating a passphrase defeats the goal of a passwordless login if you are not going to use ssh-agent. By default, the keypair would be stored in ~/.ssh/


Upload the public key to the remote machine
$ scp ~/.ssh/id_rsa.pub theuser@theserver.com:~/

Setup the public key on the remote machine
$ ssh theuser@theserver.com
$ mkdir ~/.ssh
$ chmod 700 ~/.ssh
$ cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys

The permissions are important, SSH would not read an authorized_keys file that is readable by other users and make sure the ".ssh" folder permission is 700 or it will not work.

If the SSH daemon is configured to allow public key authentication then there is nothing more to do. If not, make sure to do the following:

edit /etc/ssh/sshd_config and set the value shown below
PubkeyAuthentication yes
 AuthorizedKeysFile .ssh/authorized_keys