Ssh - Revision history

M: /* Upgrading a system with an old key */

2023-03-21T14:57:53Z

Upgrading a system with an old key

← Older revision		Revision as of 14:57, 21 March 2023
Line 23:		Line 23:
	* Using two terminals, copy/paste the newer key into place, and remove the old		* Using two terminals, copy/paste the newer key into place, and remove the old
	* Undo sshd changes and verify you can connect		* Undo sshd changes and verify you can connect
			* Fix ~/.ssh/config to point to the new key. This gets tricky bc you must change the file that has also been changed upstream.
			emacs ~/.ssh/config # change key
			cd development/config
			git commit -a -m "Fix (host) config"
			git pull # and fix merge up
			git push

	=== Clean room hardened config ===		=== Clean room hardened config ===

2023-03-21T14:48:51Z

@@ Line 10: / Line 10: @@
   # -- COPY AND PASTE END --
 * Control-D to disconnect and ssh back in to make sure it's working
 === Clean room hardened config ===

2022-03-09T22:40:35Z

Quickstart

← Older revision		Revision as of 22:40, 9 March 2022
Line 6:		Line 6:
	mkdir -p .ssh		mkdir -p .ssh
	cd .ssh		cd .ssh
	scp $GOODHOST:.ssh/~~id_rsa~~* .		scp $GOODHOST:.ssh/id_ed25519* .
	cat ~~id_rsa~~.pub >> authorized_keys		cat id_ed25519.pub >> authorized_keys
	# -- COPY AND PASTE END --		# -- COPY AND PASTE END --
	* Control-D to disconnect and ssh back in to make sure it's working		* Control-D to disconnect and ssh back in to make sure it's working

2022-03-09T22:39:45Z

← Older revision		Revision as of 22:39, 9 March 2022
Line 37:		Line 37:
	* If you need a new identity, use this to generate the keys:		* If you need a new identity, use this to generate the keys:
	cd ~/.ssh		cd ~/.ssh
	ssh-keygen -t ~~rsa -b 4096~~ -C moodboom@gmail.com		# use ed25519, the newest cipher, it's smaller, performs better AND more secure
			ssh-keygen -t ed25519 -C moodboom@gmail.com
	chmod 400 id_rsa		chmod 400 id_rsa
	cat id_rsa.pub >> authorized_keys		cat id_rsa.pub >> authorized_keys

2021-04-18T14:58:46Z

Server

← Older revision		Revision as of 14:58, 18 April 2021
Line 32:		Line 32:
	cd /home/$USER/ && chmod g-w,o-w .ssh/ #The directory containing your .ssh directory must not be writeable by group or others		cd /home/$USER/ && chmod g-w,o-w .ssh/ #The directory containing your .ssh directory must not be writeable by group or others
	chmod 600 /home/$USER/.ssh/authorized_keys #change permissions to r+w only for user		chmod 600 /home/$USER/.ssh/authorized_keys #change permissions to r+w only for user
	sudo service sshd restart #restart and reload keys into the SSH deamon		sudo service sshd restart #restart and reload keys into the SSH deamon

	=== Generate fresh keys ===		=== Generate fresh keys ===

2021-04-18T14:58:27Z

Server

← Older revision		Revision as of 14:58, 18 April 2021
Line 30:		Line 30:
	rm /home/$USER/.ssh/id_* #Delete old SSH keys		rm /home/$USER/.ssh/id_* #Delete old SSH keys
	vi /home/$USER/.ssh/authorized_keys #paste public key here		vi /home/$USER/.ssh/authorized_keys #paste public key here
	cd /home/$USER/ && chmod g-w,o-w .ssh/ #The directory containing your .ssh directory must		cd /home/$USER/ && chmod g-w,o-w .ssh/ #The directory containing your .ssh directory must not be writeable by group or others
	not be writeable by group or others
	chmod 600 /home/$USER/.ssh/authorized_keys #change permissions to r+w only for user		chmod 600 /home/$USER/.ssh/authorized_keys #change permissions to r+w only for user
	service sshd restart #restart and reload keys into the SSH deamon		sudo service sshd restart #restart and reload keys into the SSH deamon

	=== Generate fresh keys ===		=== Generate fresh keys ===

2021-04-18T14:57:02Z

Server

← Older revision		Revision as of 14:57, 18 April 2021
Line 25:		Line 25:
	chown $USER:$USER /home/$USER/.ssh/id_ed25519*		chown $USER:$USER /home/$USER/.ssh/id_ed25519*
	==== Server ====		==== Server ====
	rm /etc/ssh/ssh_host_* #Delete old SSH keys		sudo rm /etc/ssh/ssh_host_* #Delete old SSH keys
	rm ~/.ssh/id_* #Delete old SSH keys		rm ~/.ssh/id_* #Delete old SSH keys
	sudo dpkg-reconfigure openssh-server #Reset SSH config to defaults and generate new key files		sudo dpkg-reconfigure openssh-server #Reset SSH config to defaults and generate new key files

2021-04-16T16:27:06Z

@@ Line 10: / Line 10: @@
   # -- COPY AND PASTE END --
 * Control-D to disconnect and ssh back in to make sure it's working
 === Generate fresh keys ===

2018-01-28T16:37:01Z

← Older revision		Revision as of 16:37, 28 January 2018
Line 10:		Line 10:
	# -- COPY AND PASTE END --		# -- COPY AND PASTE END --
	* Control-D to disconnect and ssh back in to make sure it's working		* Control-D to disconnect and ssh back in to make sure it's working

			=== Generate fresh keys ===
			* If you need a new identity, use this to generate the keys:
			cd ~/.ssh
			ssh-keygen -t rsa -b 4096 -C moodboom@gmail.com
			chmod 400 id_rsa
			cat id_rsa.pub >> authorized_keys

	=== Shortcut and Key organization ===		=== Shortcut and Key organization ===

2017-10-11T18:40:30Z

← Older revision		Revision as of 18:40, 11 October 2017
Line 20:		Line 20:
	* server: enable in /etc/ssh/sshd_config		* server: enable in /etc/ssh/sshd_config
	* server: make sure you have an X environment installed (install of any X app will pull it in)		* server: make sure you have an X environment installed (install of any X app will pull it in)
			* client: set [ForwardX11Trusted yes] in /etc/ssh/ssh_config (no doesn't work)
	* client: make sure you have an X server environment - on windows, use [[x2go]]		* client: make sure you have an X server environment - on windows, use [[x2go]]
	* if you need to become root after you have ssh'ed (for example to run wireshark), do this magic to patch in x authorization, oh yeah!		* if you need to become root after you have ssh'ed (for example to run wireshark), do this magic to patch in x authorization, oh yeah!
Line 28:		Line 29:

	NOTE: This step gets it going automatically, but that has messed with the ability to ssh/git through non-X servers like bitpost. Just use [ssh -Y] as needed.		NOTE: This step gets it going automatically, but that has messed with the ability to ssh/git through non-X servers like bitpost. Just use [ssh -Y] as needed.
	* client: set ~~default-on~~ in /etc/ssh/ssh_config (in place of ssh -Y)		* client: set [ForwardX11 yes] in /etc/ssh/ssh_config (in place of ssh -Y)

	=== ProxyJump ===		=== ProxyJump ===