[download this tutorial as a PDF]

SSH (Secure SHell) is a cryptographic network protocol which allows users to securely perform a number of network services over an unsecured network. The CSE Dept has one server (john.cse.taylor.edu) that is accessible from the Internet via SSH (only). This server is also locked down very tightly so that an incorrect password will lock you from accessing the server for a period of time. This can become frustrating, but can be overcome by setting up an SSH key pair so that you don't need to enter your password to access the server. That is what this tutorial is all about.

In this tutorial we will cover:

The Background
Generating Your SSH Key Pair
- Linux/Mac
- Windows

The Background

As mentioned above, SSH (Secure SHell) is a cryptographic network protocol which allows users to securely perform a number of network services over an unsecured network. SSH Keys provide a more secure way of logging in to a server with SSH than using a password alone. While a password can eventually be cracked with a brute force attack, SSH keys are nearly impossible to decipher by brute force alone.

An SSH key pair consists of two long strings of characters: a public key and a private key. These keys are generated using a cryptographic algorithm that provides literally trillions of possible combinations, so the chances of generating an identical key pair as someone else is almost nil. It might help to think of the public key as a padlock, and the private key as the key that unlocks that padlock:


Public Key	Private Key

In this example, you wouldn't necessarily care about how many padlocks exist and where they are. The padlocks can be distributed anywhere -- toss them all over the place. As long as your key is secure, it doesn't matter where the padlocks are living. You wouldn't care if there were hundreds of copies of the same padlock locking your things as long as you never lost possession of the key that opens them. This holds true for a public/private SSH key pair as well.

You can place the public key (padlock) on any server, then unlock it by connecting to it with a client that already has the private key (key). When the two match up, the system allows the user to connect (unlocks) without the need for a password. You can increase the security even more by protecting the private key with a passphrase. In the padlock analogy, the passphrase would be like placing the physical key into a safe to which only you have the combination. You are not required to use a passphrase, but if you do you will need to enter it every time you attempt to use that key pair.

In the padlock analogy, you would want to make sure you never lose the key or make a copy of it for others to use. You would also not leave the key lying around for anyone to pick up and use for themselves. It is also very important for you to keep your SSH private key safe. Do not EVER copy it to any other computer. In addition, anyone with access to the computer where your private key is kept can log in to any server that has your public key without having to know your password (unless you have provided a passphrase for the key pair). For this reason, you should keep your computer password-protected and log off whenever you are not using it.

When you connect to the remote server, if there is a public key identified in the authorized_users file that corresponds to the private key on the computer you are connecting from, the remote server will check the public key against the private key to see that they match. If they do, access is granted to the remote server without needing a password.

(Thanks to http://blakesmith.me/2010/02/08/understanding-public-key-private-key-concepts.html for the padlock example.)

Generating Your SSH Key Pair

The General Idea

In general, this process includes two steps:

Generating your public/private key pair.
Copying your public key to the server(s) to which you want to authenticate.

The key files are generally saved in your home directory (denoted by ~) under the .ssh folder as id_rsa (private key) and id_rsa.pub (public key). ONLY copy your public key to other places; NEVER copy your private key ANYWHERE else!

Your public key should be copied into a file on the server to which you want to connect as part of a file called authorized_keys in the .ssh folder inside your home directory on that server.

The first time you connect to a remote server, the address of that server will be placed in a file called known_hosts inside the .ssh folder in your home directory. The next time you connect to that server, the address will be seen in this file, and you will not be asked to confirm that you want to connect.

Your Computer	Server (e.g., john.cse.taylor.edu)
~/.ssh/id_rsa (private key) ~/.ssh/id_rsa.pub (public key) ~/.ssh/known_hosts (hosts that OpenSSH knows about)	~/.ssh/authorized_keys (public keys allowed to connect to this server)

Instructions for Linux/Mac Computers

Generate Your Public/Private Key Pair

On your computer, open a terminal and type:

ssh-keygen -t rsa

You should see a response like this:

Generating public/private rsa key pair.
Enter file in which to save the key ({your home dir}/.ssh/id_rsa):

Just press <Enter> to accept the default location and file name. If the .ssh directory doesn't exist, the system will create it for you. You will then see a prompt like this:

Enter passphrase (empty for no passphrase):

Just press <Enter> twice for no passphrase (it is not necessary). Or, if you choose to create a passphrase, enter it twice. You will then see the following response:

Your identification has been saved in {your home dir}/.ssh/id_rsa.
Your public key has been saved in {your hame dir}/.ssh/id_rsa.pub.
The key fingerprint is:

...followed by lines containing hexadecimal characters and a randomart image for the key.

Copy Your Public Key to john.cse.taylor.edu

In the following examples, replace {CSE_username} with your actual CSE username.

Type the command:

ssh-copy-id -i ~/.ssh/id_rsa.pub {CSE_username}@john.cse.taylor.edu

You should be prompted to enter your CSE password during this process. If successful, you should be able to type the command:

ssh {CSE_username}@john.cse.taylor.edu

and it should connect without asking for your password.

Instructions for Windows Computers

Windows 10 now has a built-in OpenSSH client installed by default (in newer updates). Test that you have it installed by typing ssh at a command prompt. If the system responds with 'ssh' is not recognized as an internal or external command, operable program or batch file, then you will need to install it by doing the following:

Click on Start and choose Settings.
Click on Apps and choose Apps & features. From the Apps & features page, click Manage optional features.
Click on Add a feature.
Scroll down the list and click OpenSSH Client (Beta) option and click Install (there is no need to install the OpenSSH Server feature).

Generate Your Public/Private Key Pair

Open up a command prompt and type:

ssh-keygen -t rsa

You should see a response like this:

Generating public/private rsa key pair.
Enter file in which to save the key (C:\Users\{username}/.ssh/id_rsa):

Just press <Enter> to accept the default location and file name. If the .ssh directory doesn't exist, the system will create it for you. You will then see a prompt like this:

Enter passphrase (empty for no passphrase):

Just press <Enter> twice for no passphrase. Or, if you choose to create a passphrase, enter it twice. You will then see the following response:

Your identification has been saved in C:\Users\{username}/.ssh/id_rsa.
Your public key has been saved in C:\Users\{username}/.ssh/id_rsa.pub
The key fingerprint is:

...followed by lines containing hexadecimal characters and a randomart image for the key.

Copy Your Public Key to john.cse.taylor.edu

git_windows Unfortunately, the ssh-copy-id command is not included in the Windows 10 version of OpenSSH for security reasons. You will need to either manually copy/paste the contents of your id_rsa.pub file into the authorized_keys file on john.cse.taylor.edu, or use a third party application to do so. The easiest route is to install Git for Windows. It installs a bash shell environment onto your computer, which includes the OpenSSH tools (including ssh-copy-id). We will use this option.

Install Git for Windows

Download Git for Windows from https://git-scm.com/download/win.
Open the downloaded file to start the installer. Take all the default options.
Once installed, in Windows Explorer navigate to your user folder (usually C:\Users\{your username}). Right-click on the .ssh folder and choose Git Bash Here. This will open a git bash session at that location (see example window to the right).

Copy the Public Key

In the following examples, replace {CSE_username} with your actual CSE username.

Type the command:

ssh-copy-id -i ~/.ssh/id_rsa.pub {CSE_username}@john.cse.taylor.edu

You should be prompted for your CSE password during this process. If successful, you should be able to type the command:

ssh {CSE_username}@john.cse.taylor.edu

and it should connect without asking for your password.

Type exit to close the git bash window. If you choose to continue to use Git for Windows, you can. However, it is not necessary for connecting to john.cse.taylor.edu. From now on, you can type the ssh command above from any command prompt to connect to john.cse.taylor.edu.