How to set up keyfile-based ssh logins between Unix/Linux systems
On the system you're planning to use as the source of the ssh session (that is, if you're on system A and want to log into system B using "ssh username@B", then we're talking about system A here): |
cd ~/.ssh ssh-keygen -t dsa -C "identifying comment" |
Notes: The The |
The |
|
Generating public/private dsa key pair. Enter file in which to save the key (/xx/xx/.ssh/id_dsa): |
Choosing the default is generally the right thing to do. If you're generating multiple keys, they should
all be in different files, but most people just generate one per system, or at most,
one DSA key called |
Enter passphrase (empty for no passphrase): Enter same passphrase again: |
It is a good idea to put a passphrase on a key, but since most people use this key method to avoid having to type in a password, the way to do that is just to hit enter twice here, adding no passphrase. |
The |
|
Your identification has been saved in /xx/xx/.ssh/id_dsa. Your public key has been saved in /xx/xx/.ssh/id_dsa.pub. The key fingerprint is: xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx identifying comment Now, scp the scp id_dsa.pub user@B:.ssh/A-dsa-key.pub System B will ask for your password here and then Now, ssh to your account on system B. (You'll still need to provide a password, as the last step in setting up the keyfile is yet to come.) The most common versions of ssh (OpenSSH and variants of it) want you to do this: |
|
cd .ssh touch authorized_keys cat A-dsa-key.pub >> authorized_keys |
This adds the information in the Note: on some systems, this file's name is something other than Note: Some versions of ssh server use a different scheme,
where you keep the |
Once this is done, when you're on system A and type "ssh username@B", system B will check to see if the
key corresponding to your system A "id_dsa" file is among those known to your user (i.e., it is
in the authorized_keys file in your user's .ssh subdirectory). If it is, it won't ask for a
system password, it will ask for the key's associated passphrase, which means that if you've set it up with no
passphrase, you're on without having to type anything. |
|