{"id":228,"date":"2015-02-09T14:38:53","date_gmt":"2015-02-09T22:38:53","guid":{"rendered":"http:\/\/eyedtentea.com\/?p=228"},"modified":"2015-02-09T14:38:53","modified_gmt":"2015-02-09T22:38:53","slug":"multiple-rsa-key-pairs-using-ssh-keygen-sshconfig-mac-os-x-tutorial","status":"publish","type":"post","link":"https:\/\/eyedtentea.com\/?p=228","title":{"rendered":"Multiple RSA key pairs using ssh-keygen &#038; .ssh\/config (Mac OS X tutorial)"},"content":{"rendered":"<p>I got tired of typing my password after <code>ssh<\/code>&#8216;ing to remote servers. After some googling, I found the solution, the\u00a0<code>ssh-keygen<\/code> command and <code>ssh-copy-id<\/code> command. <code>ssh-keygen<\/code> generates an rsa private\/public key pair. Once you generate the\u00a0keys, you&#8217;ll need to store the private key on your computer and the public key to the server. <code>ssh-copy-id<\/code> command is used to copy the rsa public key onto the remote server. This command will also\u00a0create the necessary file\u00a0and change the necessary permissions to make this all work.<\/p>\n<p>I followed a tutorial from Ramesh Natarajan (<a href=\"http:\/\/goo.gl\/fX68N\" target=\"_blank\">http:\/\/goo.gl\/fX68N<\/a>). I\u00a0got stuck on trying to copy the public key to the remote server. I&#8217;m on a Mac and apparently <code>ssh-copy-id<\/code> command is not\u00a0built in. I found the Mac install (located at <a href=\"https:\/\/github.com\/beautifulcode\/ssh-copy-id-for-OSX\" target=\"_blank\">GitHub<\/a>, MacPorts or Homebrew) and completed Ramesh&#8217;s tutorial. I was able to\u00a0quickly connect\u00a0to the\u00a0remote server\u00a0without typing in the password&#8230; How sweet is that?<\/p>\n<p>All was good until I started to frequently connect to different servers. Ramesh&#8217;s tutorial covers a\u00a0single rsa key pair. For security, it&#8217;s best to have a unique rsa key pair for each unique connection . After some searching, this can be accomplished by modifying the <code>ssh-keygen<\/code> command and using the <code>config<\/code> file located within the hidden <code>.ssh<\/code> directory.<\/p>\n<hr \/>\n<p>I first began by creating another unique rsa key pair:<\/p>\n<pre>ssh-keygen -f ~\/.ssh\/id_rsa_userA -C \"userA @ server1\"<\/pre>\n<ul>\n<li>The <code>-f<\/code> flag specifies the filename of the key file. In the example, it is &#8220;<code>id_rsa_userA<\/code>&#8220;. The private key will be &#8220;<code>id_rsa_userA<\/code>&#8221; and the public key will be &#8220;<code>id_rsa_userA.pub\"<\/code>. As you can see from the absolute path, the files will be locate in the home directory and within a hidden <code>.ssh<\/code> folder.<\/li>\n<li>The <code>-C<\/code> flag is for commenting. The string that follows will be appended to the end of the rsa public key. This helps when you copy the public key to the remote server &#8212; you&#8217;ll know it was copied\u00a0because of the comment you provided.<\/li>\n<\/ul>\n<p>The following is what you will typically see after you execute the previous line of code.<\/p>\n<pre>Generating public\/private rsa key pair.\r\nEnter passphrase (empty for no passphrase): <em>[enter something complex]<\/em>\r\nEnter same passphrase again: <em>[confirm by entering it again]<\/em>\r\nYour public key has been saved in \/Users\/username\/.ssh\/id_rsa_userA.pub.\r\nThe key fingerprint is:\r\n81:d4:12:cd:57:aa:42:47:12:de:4c:23:6a:34:62:78 userA @ somedomain.com\r\nThe key's random art image is:\r\n+--[ RSA 2050]----+\r\n|        ..+0.    |\r\n|         .. .    |\r\n|         *.*     |\r\n|       +.o o     |\r\n|     .. +        |\r\n|      S.  ..     |\r\n|        ..       |\r\n|       o + . . . |\r\n|        .  +o.oE+|\r\n+-----------------+\r\n<\/pre>\n<ul>\n<li>After generating the rsa key pair, you have the option of entering a passphrase. You should do this! Check out this GitHub article on that (<a href=\"http:\/\/goo.gl\/rR1ebp\" target=\"_blank\">http:\/\/goo.gl\/rR1ebp<\/a>)<\/li>\n<li>The location of the public key is given.<\/li>\n<li>The fingerprint and random art image is also generated.<\/li>\n<\/ul>\n<p>Repeat the <code>ssh-keygen<\/code> command for the other connections. Be sure to keep the filename of the key file unique and the comment unique, as well as relevant to the connection.<\/p>\n<hr \/>\n<p>Use\u00a0<code>ssh-copy-id<\/code>\u00a0to copy the public rsa key to the remote server. (Install via\u00a0<a href=\"https:\/\/github.com\/beautifulcode\/ssh-copy-id-for-OSX\" target=\"_blank\">GitHub<\/a>, MacPorts or Homebrew).<\/p>\n<pre>ssh-copy-id -i ~\/.ssh\/id_rsa_userA.pub userA@somedomain.com<\/pre>\n<ul>\n<li>The <code>-i<\/code> flag allows you to specify the public key to upload.<\/li>\n<li>The last argument (<code>userA@somedomain.com<\/code>) is the remote host connection info.<\/li>\n<li><code>ssh-copy-id<\/code> will create the <code>authorized_keys<\/code>\u00a0file if it doesn&#8217;t exist and append the public key (specified after the<code>-i<\/code> flag &#8220;<code>~\/.ssh\/id_rsa_userA.pub\"<\/code>). It&#8217;ll also update various file and folder permissions.<\/li>\n<li>You will be required to type in the account password to access the remote server (note: this is not the &#8220;passphrase&#8221; you created at the beginning of the tutorial)<\/li>\n<\/ul>\n<p>Test the connection again by ssh command:<\/p>\n<pre>ssh userA@somedomain.com<\/pre>\n<p>Mac OS X will then ask for you to enter the &#8220;passphrase&#8221; you should have created when you used the <code>ssh-keygen<\/code> command. It is important\u00a0to check the &#8220;Remember password in my keychain&#8221; box. By doing this, you eliminate from typing in the &#8220;passphrase&#8221; every time you login to this specific server.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-229\" src=\"http:\/\/eyedtentea.com\/wp-content\/uploads\/2015\/02\/keyChainBox-300x170.png\" alt=\"keyChainBox\" width=\"300\" height=\"170\" srcset=\"https:\/\/eyedtentea.com\/wp-content\/uploads\/2015\/02\/keyChainBox-300x170.png 300w, https:\/\/eyedtentea.com\/wp-content\/uploads\/2015\/02\/keyChainBox.png 444w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/p>\n<hr \/>\n<p>This step is not necessary, but once connected to the remote server, you can examine the <code>authorized_keys<\/code>\u00a0file:<\/p>\n<pre>cat ~\/.ssh\/authorized_keys\r\n<\/pre>\n<ul>\n<li>Within this file, you should be able to see the long key, followed by the comment included when the <code>ssh-keygen<\/code> command was executed.<\/li>\n<\/ul>\n<hr \/>\n<p>You should log out and try another <code>ssh<\/code> connection to the same server. This time, the &#8220;passphrase&#8221; is saved by Keychain Access, so you shouldn&#8217;t have type it again. If all is well, you should be instantly connected to the remote server.<\/p>\n<p>Repeat the public key transfer of all the remaining server connections.<\/p>\n<hr \/>\n<p>Next is to store all the connection info into a <code>config<\/code> file contained within the <code>.ssh<\/code> folder. This will speed up connection to the remote servers by assigning shortcut names to each unique connection.<\/p>\n<pre>touch ~\/.ssh\/config\r\nvim ~\/.ssh\/config\r\n<\/pre>\n<ul>\n<li>The file doesn&#8217;t exist, so I&#8217;m using <code>touch<\/code>\u00a0command to create the file.<\/li>\n<li>I&#8217;m using <code>Vim<\/code> to input the connection info.<\/li>\n<\/ul>\n<p>For demonstration purposes, the following contains basic connection info for two different accounts. There is a lot that you can put into the <code>config<\/code> file, but I only limited it to basic connection info.<\/p>\n<pre>Host userA\r\n  HostName somedomain.com\r\n  User userA\r\n  IdentityFile ~\/.ssh\/id_rsa_userA\r\n\r\nHost userB\r\n  HostName anotherdomain.com\r\n  User userB\r\n  IdentityFile ~\/.ssh\/id_rsa_userB\r\n<\/pre>\n<ul>\n<li><code>Host userA<\/code> and <code>Host userB<\/code>is are used for pattern matching and applies the declarations that follow it (note the indentation of the lines that follow it). <code>userA<\/code> and <code>Host userB<\/code> are the names I choose for their unique connections. This will also be used when you remote connect to the server. It&#8217;s the shortcut name, so keep this name unique.<\/li>\n<li><code>HostName somedomain.com<\/code> and <code>HostName anotherdomain.com\u00a0<\/code>states the domain of the remote servers.<\/li>\n<li><code>User userA<\/code> and <code>User userB<\/code> states the user account to\u00a0the corresponding remote server.<\/li>\n<li><code>IdentityFile ~\/.ssh\/id_rsa_userA<\/code> and <code>IdentityFile ~\/.ssh\/id_rsa_userB<\/code> states the specific private rsa key.<\/li>\n<li>More info about what can go inside the <code>config<\/code> file can be found here <a href=\"http:\/\/goo.gl\/FEF1a5\" target=\"_blank\">http:\/\/goo.gl\/FEF1a5<\/a>\u00a0or by checking out the manual pages in terminal (<code>man ssh_config<\/code>)<\/li>\n<\/ul>\n<hr \/>\n<p>That&#8217;s pretty much it. You can then quickly connect to the remote server, without inputting any password by typing in the connection type (<code>ssh<\/code>, <code>sftp<\/code>, etc) followed by the shortcut name as listed in the <code>config<\/code> file &#8212; the one after &#8220;<code>Host<\/code>&#8220;. Here are some connection examples:<\/p>\n<ul>\n<li><code>sftp userA<\/code><\/li>\n<li><code>ssh userA<\/code><\/li>\n<li><code>sftp userB<\/code><\/li>\n<li><code>ssh userB<\/code><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>I got tired of typing my password after ssh&#8216;ing to remote servers. After some googling, I found the solution, the\u00a0ssh-keygen command and ssh-copy-id command. ssh-keygen generates an rsa private\/public key pair. Once you generate the\u00a0keys, you&#8217;ll need to store the private key on your computer and the public key to the server. ssh-copy-id command is [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":233,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28],"tags":[29,94,86,92,95,24,90,96,97,98,87,88,89,85,93,22,91],"class_list":["post-228","post","type-post","status-publish","format-standard","hentry","category-tech","tag-apple","tag-command","tag-config","tag-linux","tag-mac-os-x","tag-reference","tag-remote-server","tag-rsa","tag-rsa-key-pair","tag-rsa-privatepublic-key-pair","tag-scp","tag-sftp","tag-ssh","tag-ssh_config","tag-terminal","tag-tutorial","tag-unix"],"_links":{"self":[{"href":"https:\/\/eyedtentea.com\/index.php?rest_route=\/wp\/v2\/posts\/228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eyedtentea.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eyedtentea.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eyedtentea.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/eyedtentea.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=228"}],"version-history":[{"count":5,"href":"https:\/\/eyedtentea.com\/index.php?rest_route=\/wp\/v2\/posts\/228\/revisions"}],"predecessor-version":[{"id":235,"href":"https:\/\/eyedtentea.com\/index.php?rest_route=\/wp\/v2\/posts\/228\/revisions\/235"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eyedtentea.com\/index.php?rest_route=\/wp\/v2\/media\/233"}],"wp:attachment":[{"href":"https:\/\/eyedtentea.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eyedtentea.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eyedtentea.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}