So one day, My superior gave me a task to create a process that transport data (in text file) from one nix box to another nix box. Since the target box has internet facing interface, public IP, and doesn’t have any firewall installed in any form whatsoever, it has to be over SSL. So it’s either sftp or scp. The file transport will be part of a batch process. So I choose SCP over SFTP, since it only require one line of command instead of a scripted process.
Since the process will be an unattended one, manually typing password is out of question, so I turned to public key authentication. Here are the steps:
1. Make sure the target SSH server accept public key authentication
As root, open sshd_config on the target server, usually located in /etc/ssh/sshd_config
sudo nano /etc/ssh/sshd_config
Make sure these lines are available and not commented
2. Make sure the ssh client know where the private key is located
As root, open ssh_config on the client machine, usually located on /etc/ssh/ssh_config
sudo nano /etc/ssh/ssh_config
Make sure this line is available and not commented
3. Create a pair of private and public keys
To do public key authentication, you need to have a pair of keys. Private key is stored on ssh client machine as your identification, and public key is stored on the target ssh server, used by sshd to authenticate you on ssh server.
Log into the ssh client machine with the account that you’ll be using to connect to target server, and issue this command:
ssh-keygen -t dsa
The output should be similiar to this
ikhsan@M5mobile:~/.ssh$ ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/home/ikhsan/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/ikhsan/.ssh/id_dsa.
Your public key has been saved in /home/ikhsan/.ssh/id_dsa.pub.
The key fingerprint is:
Since my requirement was passwordless authentication, I didn’t enter any passphrase. Note that the private (id_dsa) and public (id_dsa.pub) keys have been generated, and stored .ssh directory
ikhsan@M5mobile:~$ cd .ssh
authorized_keys id_dsa id_dsa.pub id_rsa id_rsa.pub
4. Install the public key into the target ssh server
Copy the public key into target ssh server
ikhsan@M5mobile:~$ cd .ssh
ikhsan@M5mobile:~/.ssh$ scp id_dsa.pub surfer@M5base:/home/surfer/.ssh
id_dsa.pub 100% 605 0.6KB/s 00:00
log into the ssh server as the user that will use the passwordless authentication, in my case, it’s “surfer”. Install the public key into the server by issuing this command:
surfer@M5base:~$ cd .ssh
surfer@M5base:~/.ssh$ cat id_dsa.pub >> authorized_keys
The above commands will add the public key into authorized_keys file. It is important to do add the key by using the above command so that any existing keys in the authorized_keys file are not overwritten.
Sometime, the .ssh folder is not available, and you are required to create them manually. This may cause some problem regarding the access restriction of that folder. To create the folder, do the following:
surfer@M5base:~$ mkdir .ssh surfer@M5base:~$ chmod -R 700 .ssh
Go here for more about the problem.
5. Test your connection
Try to log to the target ssh server, the output should be close to this:
ikhsan@M5mobile:~/.ssh$ ssh surfer@M5base
Linux M5base 2.6.20-15-generic #2 SMP Sun Apr 15 07:36:31 UTC 2007 i686
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
Last login: Wed Oct 31 21:57:19 2007 from localhost
Now you can test your setup by copying file from ssh client machine to the ssh server:
ikhsan@M5mobile:~$ scp w3sp_BigPianoAlbum.rar surfer@M5base:/home/surfer w3sp_BigPianoAlbum.rar 100% 33MB 11.2MB/s 00:03
… and you’re done
If you created the .ssh folder manually, you might run into some problem where the public key authentication is bypassed due to the security level of the .ssh folder. Go here for the solution regarding this problem