<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body ><div><br></div><div><br></div><div><br></div><div><div style="font-size:9px;color:#575757">Sent from my Samsung Galaxy smartphone.</div></div><div></div><br><br><div style="font-size:100%;text-align:left;color:#000000">-------- Original message --------<br>From: Karl Auer <kauer@biplane.com.au> <br>Date:16/02/2015 5:28 PM (GMT+10:00) <br>To: ubuntu-users@lists.ubuntu.com <br>Cc: <br>Subject: Re: ssh host v client regarding keys <br><br></div>On Mon, 2015-02-16 at 05:13 +0000, thufir wrote:<br>> on the host, I created a key with ssh-keygen -t rsa but that's on the pc <br>> which I'm connecting. do I transfer that key to the client with ssh-copy <br>> id ? Or the other way around?<br><br>Host: The system you are connecting TO<br>Client: The system you are connecting FROM<br><br>Assuming cuser on the client wants lo log into the host as huser:<br><br>On the client, run ssh-keygen as cuser to create a ~cuser/.ssh and a new<br>key pair. Put the new key pair in ~cuser/.ssh (that's the default)<br>unless you know exactly what you are doing. If cuser already has a<br>suitable directory and key pair, skip this step.<br><br>On the host, run ssh-keygen as huser to create ~huser/.ssh and a new key<br>pair. Put the new key pair in ~huser/.ssh (that's the default) unless<br>you know exactly what you are doing. If huser already has a suitable<br>directory and key pair, skip this step. Otherwise, delete the generated<br>keys afterwards. You don't need them for logging in from the client.<br><br>Now copy the PUBLIC part of cuser's key (that's the file with the .pub<br>extension) from ~cuser/.ssh into ~huser/.ssh on the host.<br><br>In ~huser/.ssh on the host, append the newly copied public key<br>to .ssh/authorized_keys.<br><br>Finally, delete the public key from ~huser/.ssh <br><br>That's it.<br><br>A couple of points though:<br>- DO NOT copy your private key to anywhere<br>- DO NOT create keys without passphrases<br>- make your passphrases very hard to guess<br>- authorized_keys should be world-readable<br>- authorized_keys should be writable only by the owner<br>- once you have publickey-protected access, consider<br> turning off password-only access<br><br>There are lots of short-cuts and additional ways to do things, but for<br>the sake of obviousness, I've described it in clunky but simple steps.<br>Alternatively, while logged in as cuser on the client, do something like<br>this (untested, just to give you the idea). This requires you to enter<br>the huser password two or three times):<br><br> cd<br> ssh-keygen -t rsa -b 4096 [if cuser doesn't have keys]<br> ssh huser@host ssh-keygen [if huser doesn't have .ssh]<br> scp .ssh/id_rsa.pub huser@host:.ssh/cuser.pub<br> ssh huser@host "cat .ssh/cuser.pub >> .ssh/authorized_keys ;<br>rm .ssh/cuser.pub"<br><br>Another alternative, if you have a terminal window open on both host and<br>client, is to display cuser's public key in the client window, edit<br>~huser/.ssh/authorized_keys in the host window, and just copy and paste<br>the key into authorized_keys.<br><br>Regards, K.<br><br>-- <br>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>Karl Auer (kauer@biplane.com.au)<br>http://www.biplane.com.au/kauer<br>http://twitter.com/kauer389<br><br>Thanks Karl thats one of the best and easiest descriptions i have read. And ta to thufir for asking . . .<div><br></div><div>Phil</div></body></html>