Difference between revisions of "SSH"

From CSE330 Wiki
Jump to navigationJump to search
(Assorted SSH changes from test in CEC lab)
 
(37 intermediate revisions by 4 users not shown)
Line 14: Line 14:
  
 
This section discusses how to set up your computer and your remote instance for SSH.  You need to do this only once.
 
This section discusses how to set up your computer and your remote instance for SSH.  You need to do this only once.
 +
 +
{{RequiredInstructions|content=
  
 
=== Creating an SSH Key Pair ===
 
=== Creating an SSH Key Pair ===
Line 19: Line 21:
 
You should create your own SSH Key Pair.  You will keep the private key on your own computer, and you will upload the public key to all places to which you need to connect.
 
You should create your own SSH Key Pair.  You will keep the private key on your own computer, and you will upload the public key to all places to which you need to connect.
  
To generate a key pair, open Terminal or [[Workflow#Cygwin|Cygwin, which you will need to install if on a personal Windows computer,]] and run the following command:
+
To generate a key pair, open a terminal ([[Workflow#Installing_a_Terminal_Emulator|on Windows, you'll need to have enabled WSL or installed Cygwin]] and run the following command:
 +
 
 +
<source lang="bash"># Run on Local Machine in Terminal or Cygwin
 +
$ ssh-keygen</source>
  
<source lang="bash">$ ssh-keygen</source>
+
'''Important:''' Don't name the file unless you are using a CEC machine. If you are using a CEC machine, name the file ''/cygdrive/h/.ssh/id_rsa''
  
Keep the default location.  For the purposes of this course, you do not need to enter a passphrase, although you would probably want one in real life.
+
For the purposes of this course, you do not need to enter a passphrase, although you would probably want one in real life.
  
 
Your keys should have been created in ~/.ssh.  Check to make sure they exist using the ''ls'' command:
 
Your keys should have been created in ~/.ssh.  Check to make sure they exist using the ''ls'' command:
Line 36: Line 41:
 
<source lang="bash">
 
<source lang="bash">
 
$ cat ~/.ssh/id_rsa.pub
 
$ cat ~/.ssh/id_rsa.pub
ssh-rsa SomeLongGibberishStringOfCharacters yourname@somedomain
+
ssh-rsa AAAA3Bblahblahblahblah yourname@somedomain
 
</source>
 
</source>
  
We will need this later.  Let's now add our key to the ''ssh-agent'':
+
We will need this later.  Let's now add our key to the ''ssh-agent''.
 +
 
 +
==== SSH Agent: OS X ====
 +
 
 +
Run the following command to add your key to the SSH agent in Mac OS X.
 +
 
 +
<source lang="bash"># Non-Cygwin
 +
$ ssh-add</source>
 +
 
 +
==== SSH Agent: WSL or Cygwin ====
 +
 
 +
In order to make the SSH agent run when you start your terminal, you need to run a couple more commands (these will add a line to your .bashrc file, which runs automatically on startup):
  
<source lang="bash">$ ssh-add</source>
+
<source lang="bash">
 +
# Cygwin only
 +
$ echo "eval \`ssh-agent -s\`; ssh-add" >> ~/.bashrc
 +
$ source ~/.bashrc # reload the Bash shell
 +
</source>
  
Don't forget this step!
+
If you get this scary-looking error after you run the second command…
  
''' Cygwin Only:''' In order to make the SSH agent run when you start Cygwin, you need to run a couple more commands (these will add a couple of lines to your .bashrc file):
+
<source lang="text">
 +
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 +
@        WARNING: UNPROTECTED PRIVATE KEY FILE!          @
 +
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 +
</source>
 +
 
 +
…then you need to do the following to fix the permissions:
 +
 
 +
<source lang="bash">
 +
$ chgrp Users </path/to/id_rsa>
 +
$ chmod 600 </path/to/id_rsa>
 +
</source>
  
<source lang="bash">$ echo "eval `ssh-agent -s` ssh-add" >> ~/.bashrc # Cygwin only
 
$ source ~/.bashrc # reload the Bash shell</source>
 
  
 
=== Amazon EC2 SSH Configuration ===
 
=== Amazon EC2 SSH Configuration ===
  
When you first created your EC2 instance, you downloaded a *.pem file.  This is the ''private key'' for the default user ('''ubuntu''' on Ubuntu or '''ec2-user''' on AMI).  We need use this key to connect to your instance using the default user, at which point we will create a new custom user.  We will give that new user the public key that you created in the previous step.  You will then be able to log into your custom user using your personal key pair, so you won't need the default user again (although you should keep the *.pem file around just in case).
+
When you first created your EC2 instance, you downloaded a *.pem file.  This is the ''private key'' for the default user ('''ec2-user''' on AMI).  We need use this key to connect to your instance using the default user, at which point we will create a new custom user.  We will give that new user the public key that you created in the previous step.  You will then be able to log into your custom user using your personal key pair, so you won't need the default user again (although you should keep the *.pem file around just in case).
  
 
==== Logging In as the Default User ====
 
==== Logging In as the Default User ====
  
To connect to the default user on your Amazon EC2 instance, run this command in Terminal or Cygwin:
+
To connect to the default user on your Amazon EC2 instance, run this command in your terminal:
  
 
<source lang="bash">
 
<source lang="bash">
$ ssh -i /path/to/default-privatekey.pem ubuntu@ec2-xx-xx-xx-xx.compute-1.amazonaws.com # or ec2-user@... for AMI
+
# Run on Local Machine
 +
$ ssh -i </path/to/default-privatekey.pem> ec2-user@<ec2-xx-xx-xx-xx.compute-1.amazonaws.com>
 
</source>
 
</source>
 +
 +
'''Important:''' As soon as you are able to successfully log in, commands you type into your prompt will be executed on the remote instance, ''not'' your local machine.
  
 
If you get this scary-looking warning:
 
If you get this scary-looking warning:
Line 73: Line 105:
  
 
<source lang="bash">
 
<source lang="bash">
$ chmod 600 /path/to/default-privatekey.pem
+
# Run on Local Machine
 +
 
 +
# Cygwin Only:
 +
 
 +
$ chgrp Users </path/to/default-privatekey.pem>
 +
 
 +
# For Everyone:
 +
$ chmod 600 </path/to/default-privatekey.pem>
 
</source>
 
</source>
  
 
'''Food for Thought:''' Why you wouldn't want other people viewing your private key file?
 
'''Food for Thought:''' Why you wouldn't want other people viewing your private key file?
 
You should now be able to SSH into your instance.
 
  
 
==== Creating a New User with SSH Permissions ====
 
==== Creating a New User with SSH Permissions ====
Line 86: Line 123:
 
<source lang="bash">
 
<source lang="bash">
 
# Run these on your instance, not on your local machine!
 
# Run these on your instance, not on your local machine!
$ sudo useradd -r -m -c "My Full Name" <username here> # don't forget to customize `My Full Name` and `<username here>`
+
 
$ sudo passwd <username here>
+
# Don't forget to customize `<My Full Name>` and `<usernameHere>`:
$ sudo chsh -s /bin/bash <username here> # Ubuntu only
+
$ sudo useradd -r -m -c "<My Full Name>" <usernameHere>
$ sudo visudo # you need to add your username to the sudoers list.  In my demo installation, this was near line 19.
+
$ sudo passwd <usernameHere>
$ echo "AllowUsers <username here>" | sudo tee -a /etc/ssh/sshd_config # add your user to the SSH whitelist
+
 
$ sudo service ssh restart || sudo service sshd restart # restart the SSH server
+
# You need to add your username to the sudoers list.  Refer to the Linux guide for details.
 +
# Look around line 101.
 +
$ sudo visudo
 +
 
 +
# Restart the SSH server:
 +
$ sudo service sshd restart
 
</source>
 
</source>
  
Line 99: Line 141:
  
 
<source lang="bash">
 
<source lang="bash">
$ sudo su <username here> # switch to our own user to ensure that permissions are set correctly
+
# Switch to our own user to ensure that permissions are set correctly:
$ cd  # change the working directory to our user's home directory
+
$ su <username here>
$ mkdir .ssh  # make the nonexistent SSH configuration directory
+
 
$ nano .ssh/authorized_keys # create and edit the `authorized_keys` file
+
# Change the working directory to our user's home directory:
 +
$ cd
 +
 
 +
# Make the nonexistent SSH configuration directory and set its permissions:
 +
$ mkdir .ssh
 +
$ chmod 700 .ssh
 +
 
 +
# Create the `authorized_keys` file and set the permissions
 +
$ touch .ssh/authorized_keys
 +
$ chmod 600 .ssh/authorized_keys
 +
 
 +
# Edit the `authorized_keys` file
 +
$ nano .ssh/authorized_keys
 
</source>
 
</source>
  
 
For more detail on editing files on the command line, see [[Linux#File Editors|the Linux guide]].
 
For more detail on editing files on the command line, see [[Linux#File Editors|the Linux guide]].
  
Inside of the `authorized_keys` file, paste in your public key.  Your public key is the content of `~/.ssh/id_rsa.pub` *on your local machine* (it starts with "ssh-rsa").  There are a few ways to get it onto your clipboard:
+
Inside of the `authorized_keys` file, paste in your public key.  Your public key is the content of `~/.ssh/id_rsa.pub` '''on your local machine''' (it starts with "ssh-rsa").  There are a few ways to get it onto your clipboard:
  
 
# '''OS X Only:''' Open a new Terminal and run: <source lang="bash">cat ~/.ssh/id_rsa.pub | pbcopy</source> This immediately copies the contents of your public key to your clipboard.
 
# '''OS X Only:''' Open a new Terminal and run: <source lang="bash">cat ~/.ssh/id_rsa.pub | pbcopy</source> This immediately copies the contents of your public key to your clipboard.
# '''Windows Only:''' Navigate to id_rsa.pub manually, open it in your favorite text editor (like Notepad++), select all, and copy.
+
# '''Windows Only:''' Navigate to id_rsa.pub manually, open it in your favorite text editor (like Notepad++), select all, and copy. The location of id_rsa.pub might be: ''C:\cygwin\home\username\.ssh\id_rsa.pub''
 
# '''&#42;NIX Only:''' Open a new Terminal and copy the output of the following command: <source lang="bash">cat ~/.ssh/id_rsa.pub</source> Note that this won't work as advertised in Cygwin because Cygwin adds extra line breaks when you try to copy out of it.
 
# '''&#42;NIX Only:''' Open a new Terminal and copy the output of the following command: <source lang="bash">cat ~/.ssh/id_rsa.pub</source> Note that this won't work as advertised in Cygwin because Cygwin adds extra line breaks when you try to copy out of it.
  
Line 119: Line 173:
 
==== Logging In as your New User ====
 
==== Logging In as your New User ====
  
Let's test whether we can log into our instance using our own username and our own key pair. Open up a new Terminal or Cygwin and run:
+
Let's test whether we can log into our instance using our own username and our own key pair. Open up a new Terminal or Cygwin window '''on your local machine''' (not from ec2) and run:
  
 
<source lang="bash">
 
<source lang="bash">
$ ssh <username here>@ec2-xx-xx-xx-xx.compute-1.amazonaws.com
+
$ ssh <username here>@<ec2-xx-xx-xx-xx.amazonaws.com>
 
</source>
 
</source>
  
 
This is how you will be SSHing into your instances for the remainder of the semester.
 
This is how you will be SSHing into your instances for the remainder of the semester.
 +
 +
}}
 +
 +
=== Troubleshooting ===
 +
 +
Almost everyone receives the following error at some point in their career: <code>Permission denied (publickey)</code>.
 +
 +
Here are some possible causes for the error.
 +
 +
==== The Authorized Keys File ====
 +
 +
Make sure that your remote ''authorized_keys'' file contains ''exactly'' your public signature from ''id_rsa.pub''.
 +
 +
===== Pasting into Vi =====
 +
 +
If you used vi to edit your file and you forgot to enter "insert" mode before pasting in your key, it is possible that you lost the first "s" in "ssh-rsa".
 +
 +
Check the contents of authorized_keys via <code>cat ~/.ssh/authorized_keys</code> on your server.  If the output starts with "sh-rsa" instead of "ssh-rsa", edit the authorized_keys file and add the second '''s'''.
 +
 +
===== Unintentional Line Breaks =====
 +
 +
If you got your key via a <code>cat ~/.ssh/id_rsa.pub</code> and then copied it from the terminal, it's possible that you unintentionally introduced line breaks.  Ensure that the key is represented by only one line of text.
 +
 +
==== Permissions ====
 +
 +
They need to be correct on both the client side and on the server side.
 +
 +
* Local ''.ssh'' = 700
 +
* Local ''id_rsa'' = 600
 +
* Remote ''.ssh'' = 700
 +
* Remote ''authorized_keys'' = 600
 +
 +
If you are in Cygwin and the permissions don't seem to change, you might need to add the troubled file to a usergroup, like this:
 +
 +
<source lang="bash">
 +
$ chgrp Users .ssh/id_rsa
 +
</source>
 +
 +
==== The SSH Agent ====
 +
 +
You need to be sending the correct key along with your SSH Agent.  Run the following command, and you should see some output:
 +
 +
<source lang="bash">
 +
$ ssh-add -l
 +
2048 ab:cd:ef:ab:cd:ef:ab:cd:ef:ab:cd:ef:ab:cd:ef:ab:cd /path/to/.ssh/id_rsa (RSA)
 +
</source>
 +
 +
If you don't see any output, or if the output does not contain your ''id_rsa'', then you need to run:
 +
 +
<source lang="bash">
 +
$ ssh-add </path/to/.ssh/id_rsa>
 +
</source>
  
 
=== More SSH Server Configurations ===
 
=== More SSH Server Configurations ===
Line 142: Line 248:
  
 
<source lang="bash">
 
<source lang="bash">
$ sudo service ssh restart # Debian version
+
$ sudo service sshd restart
$ sudo service sshd restart # RHEL version
 
 
</source>
 
</source>
  
Line 163: Line 268:
  
 
<source lang="bash">
 
<source lang="bash">
$ ssh <username here>@ec2-xx-xx-xx-xx.compute-1.amazonaws.com
+
$ ssh <username here>@<ec2-xx-xx-xx-xx.compute-1.amazonaws.com>
 
</source>
 
</source>
  
Line 197: Line 302:
  
 
<source lang="bash">
 
<source lang="bash">
$ sshfs user@domain:/path/to/remote/directory /path/to/local/mountpoint
+
$ sshfs <user>@<domain>:</path/to/remote/directory> </path/to/local/mountpoint>
 
</source>
 
</source>
  
Line 209: Line 314:
  
 
<source lang="bash">
 
<source lang="bash">
$ sshfs -o IdentityFile=/path/to/private/key user@domain:/path/to/remote/directory /path/to/local/mountpoint
+
$ sshfs -o IdentityFile=</path/to/private/key> <user>@<domain>:</path/to/remote/directory> </path/to/local/mountpoint>
 
</source>
 
</source>
  
Line 215: Line 320:
  
 
<source lang="bash">
 
<source lang="bash">
$ fusermount -u /path/to/local/mountpoint
+
$ fusermount -u </path/to/local/mountpoint>
 
</source>
 
</source>
  
Line 221: Line 326:
  
 
Any server running an SSH server is also compatible with '''SFTP''' or Secure File Transfer Protocol.  (Compare to FTP, or File Transfer Protocol.)  SFTP is a convenient way to edit files on your computer and then upload them to your server in just a few clicks.
 
Any server running an SSH server is also compatible with '''SFTP''' or Secure File Transfer Protocol.  (Compare to FTP, or File Transfer Protocol.)  SFTP is a convenient way to edit files on your computer and then upload them to your server in just a few clicks.
 
==== FileZilla ====
 
 
You can use SFTP from the command line, or you can use any GUI file transfer client.  All FTP clients I have seen also support SFTP.  One popular FTP client is [http://www.filezilla-project.org/ Filezilla].
 
 
# Download and install FileZilla from http://filezilla-project.org/download.php?type=client
 
#: If you are using a lab computer, you can save it to your H drive.
 
# When you launch FileZilla, go to Edit→Settings or FileZilla→Preferences, and go to the SFTP options (under Connection).  Click "Add keyfile…", and choose the *.ppk file that you made earlier using Puttygen.  (If you lost that file, you can choose your *.pem file, and FileZilla will convert it for you.)
 
#: When finished, press '''OK''' (not the red ×) to save your changes.
 
# Back on the main FileZilla screen, there are four fields: Host, Username, Password, and Port.  Fill them in as follows:
 
#* '''Hostname:''' sftp://ec2-xxx-xx-xx-xxx.compute-1.amazonaws.com/
 
#* '''Username:''' The username you created on your server.
 
#* '''Password:''' Since you are using a key, you may leave this blank.
 
#*: If you changed your SSH settings to allow password-based authentication, then you could put your password in here.
 
#* '''Port:''' 22
 
# Then click Quickconnect.  If everything is configured correctly, FileZilla should log into your server.
 
 
[[File:FileZilla.png]]
 
 
On the left and right of the FileZilla window, you can drag files between your computer and your server.  Thus, you can edit a file in a text editor like Notepad++ on your decktop, and then upload it to your server by simply dragging it from the left pane to the right pane in FileZilla.
 
  
 
[[Category:Module 2]]
 
[[Category:Module 2]]

Latest revision as of 15:24, 3 June 2024

Secure SHell, or SSH, is the leading interface for connecting as an administrator from your local computer to something on the cloud. You will be using exclusively SSH to execute commands and upload files to your cloud instance. If you use a Git hosting service like BitBucket or Github, you will need SSH in order to save your changes there as well.

SSH access requires that the sshd daemon is running on the remote machine. By default, SSH is preinstalled on your EC2 instance. If you are not using an EC2 instance, simply install ssh from yum or apt on the remote machine.

SSH Keys

SSH can work using password-based authentication, but it is more common nowadays, and also more secure, to use public and private keys, also known as a key pair.

Here's how it works. You have a private copy of your key, called your private key. Servers to which you want to connect have an analog to your private key called your public key. When you attempt to connect to a server using your private key, the server checks to see if any of its public keys "fits" your private key, and if it finds a match, it lets you in.

You can think of the private key as the "key" and the public key as the "lock".

SSH Configuration

This section discusses how to set up your computer and your remote instance for SSH. You need to do this only once.

Creating an SSH Key Pair

You should create your own SSH Key Pair. You will keep the private key on your own computer, and you will upload the public key to all places to which you need to connect.

To generate a key pair, open a terminal (on Windows, you'll need to have enabled WSL or installed Cygwin and run the following command:

# Run on Local Machine in Terminal or Cygwin
$ ssh-keygen

Important: Don't name the file unless you are using a CEC machine. If you are using a CEC machine, name the file /cygdrive/h/.ssh/id_rsa

For the purposes of this course, you do not need to enter a passphrase, although you would probably want one in real life.

Your keys should have been created in ~/.ssh. Check to make sure they exist using the ls command:

$ ls ~/.ssh
id_rsa  id_rsa.pub

id_rsa is your private key, and id_rsa.pub is the corresponding public key. Let's look at the public signature of your key pair:

$ cat ~/.ssh/id_rsa.pub
ssh-rsa AAAA3Bblahblahblahblah yourname@somedomain

We will need this later. Let's now add our key to the ssh-agent.

SSH Agent: OS X

Run the following command to add your key to the SSH agent in Mac OS X.

# Non-Cygwin
$ ssh-add

SSH Agent: WSL or Cygwin

In order to make the SSH agent run when you start your terminal, you need to run a couple more commands (these will add a line to your .bashrc file, which runs automatically on startup):

# Cygwin only
$ echo "eval \`ssh-agent -s\`; ssh-add" >> ~/.bashrc
$ source ~/.bashrc # reload the Bash shell

If you get this scary-looking error after you run the second command…

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

…then you need to do the following to fix the permissions:

$ chgrp Users </path/to/id_rsa>
$ chmod 600 </path/to/id_rsa>


Amazon EC2 SSH Configuration

When you first created your EC2 instance, you downloaded a *.pem file. This is the private key for the default user (ec2-user on AMI). We need use this key to connect to your instance using the default user, at which point we will create a new custom user. We will give that new user the public key that you created in the previous step. You will then be able to log into your custom user using your personal key pair, so you won't need the default user again (although you should keep the *.pem file around just in case).

Logging In as the Default User

To connect to the default user on your Amazon EC2 instance, run this command in your terminal:

# Run on Local Machine
$ ssh -i </path/to/default-privatekey.pem> ec2-user@<ec2-xx-xx-xx-xx.compute-1.amazonaws.com>

Important: As soon as you are able to successfully log in, commands you type into your prompt will be executed on the remote instance, not your local machine.

If you get this scary-looking warning:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

…then you need to correctly set the permissions on your *.pem file. You should know how to do this from the Linux guide, but in case you didn't catch that detail, run:

# Run on Local Machine

# Cygwin Only:

 $ chgrp Users </path/to/default-privatekey.pem>

# For Everyone:
$ chmod 600 </path/to/default-privatekey.pem>

Food for Thought: Why you wouldn't want other people viewing your private key file?

Creating a New User with SSH Permissions

First, you need to create your new user with sudo and SSH permissions. Again, the instructions for this are in the Linux guide, but to keep everything in one place, the commands are:

# Run these on your instance, not on your local machine!

# Don't forget to customize `<My Full Name>` and `<usernameHere>`:
$ sudo useradd -r -m -c "<My Full Name>" <usernameHere>
$ sudo passwd <usernameHere>

# You need to add your username to the sudoers list.  Refer to the Linux guide for details.
# Look around line 101.
$ sudo visudo 

# Restart the SSH server:
$ sudo service sshd restart

Okay, cool: we have created our custom username on our remote instance. Now, we need to enable this account to accept our SSH key when authenticating. To do this, we need to add our public key to a file named authorized_keys, which is stored in your remote username's SSH configuration directory.

To create the directory and edit the file, run on your instance:

# Switch to our own user to ensure that permissions are set correctly:
$ su <username here>

# Change the working directory to our user's home directory:
$ cd

# Make the nonexistent SSH configuration directory and set its permissions:
$ mkdir .ssh
$ chmod 700 .ssh

# Create the `authorized_keys` file and set the permissions
$ touch .ssh/authorized_keys
$ chmod 600 .ssh/authorized_keys

# Edit the `authorized_keys` file
$ nano .ssh/authorized_keys

For more detail on editing files on the command line, see the Linux guide.

Inside of the `authorized_keys` file, paste in your public key. Your public key is the content of `~/.ssh/id_rsa.pub` on your local machine (it starts with "ssh-rsa"). There are a few ways to get it onto your clipboard:

  1. OS X Only: Open a new Terminal and run:
    cat ~/.ssh/id_rsa.pub | pbcopy
    
    This immediately copies the contents of your public key to your clipboard.
  2. Windows Only: Navigate to id_rsa.pub manually, open it in your favorite text editor (like Notepad++), select all, and copy. The location of id_rsa.pub might be: C:\cygwin\home\username\.ssh\id_rsa.pub
  3. *NIX Only: Open a new Terminal and copy the output of the following command:
    cat ~/.ssh/id_rsa.pub
    
    Note that this won't work as advertised in Cygwin because Cygwin adds extra line breaks when you try to copy out of it.

When finished, save and close `authorized_keys`.

Food for Thought: How would you enable your remote user to authenticate over SSH using the same default key instead of the one you created using ssh-keygen?

Logging In as your New User

Let's test whether we can log into our instance using our own username and our own key pair. Open up a new Terminal or Cygwin window on your local machine (not from ec2) and run:

$ ssh <username here>@<ec2-xx-xx-xx-xx.amazonaws.com>

This is how you will be SSHing into your instances for the remainder of the semester.

Troubleshooting

Almost everyone receives the following error at some point in their career: Permission denied (publickey).

Here are some possible causes for the error.

The Authorized Keys File

Make sure that your remote authorized_keys file contains exactly your public signature from id_rsa.pub.

Pasting into Vi

If you used vi to edit your file and you forgot to enter "insert" mode before pasting in your key, it is possible that you lost the first "s" in "ssh-rsa".

Check the contents of authorized_keys via cat ~/.ssh/authorized_keys on your server. If the output starts with "sh-rsa" instead of "ssh-rsa", edit the authorized_keys file and add the second s.

Unintentional Line Breaks

If you got your key via a cat ~/.ssh/id_rsa.pub and then copied it from the terminal, it's possible that you unintentionally introduced line breaks. Ensure that the key is represented by only one line of text.

Permissions

They need to be correct on both the client side and on the server side.

  • Local .ssh = 700
  • Local id_rsa = 600
  • Remote .ssh = 700
  • Remote authorized_keys = 600

If you are in Cygwin and the permissions don't seem to change, you might need to add the troubled file to a usergroup, like this:

$ chgrp Users .ssh/id_rsa

The SSH Agent

You need to be sending the correct key along with your SSH Agent. Run the following command, and you should see some output:

$ ssh-add -l
2048 ab:cd:ef:ab:cd:ef:ab:cd:ef:ab:cd:ef:ab:cd:ef:ab:cd /path/to/.ssh/id_rsa (RSA)

If you don't see any output, or if the output does not contain your id_rsa, then you need to run:

$ ssh-add </path/to/.ssh/id_rsa>

More SSH Server Configurations

Up to this point, we have been using all of the default SSH configurations. Like most things in Linux, SSH can be customized.

For the purposes of CSE 330, the additional configurations in this short section are optional; this serves only as a reference.

Disabling Root Access

It is almost always a good idea to disable root access over ssh. This could be done by editing /etc/ssh/sshd_config and setting

PermitRootLogin no

You will need to restart the SSH server for changes to take effect:

$ sudo service sshd restart

Enabling Password-Based Authentication

Up to this point, we have been using key pairs for SSH. A public/private key pair is generally considered to be more secure, but it requires that you always have access to your private key file when you want to log into your remote machine.

By default, EC2 instances allow only public/private key pair authentication. You can enable password-based authentication by setting the PaswordAuthentication option in /etc/ssh/sshd_config to yes:

PasswordAuthentication yes

There may be a line with this option that you can un-comment. For me, it is line 25. You will need to restart the server for changes to take effect.

If possible, however, you should restrict yourself to using private and public keys.

Using SSH

Once you have completed the #SSH Configuration section above, all you need to do in order to SSH into your instance is to open a terminal and run:

$ ssh <username here>@<ec2-xx-xx-xx-xx.compute-1.amazonaws.com>

PuTTY

This short section about PuTTY serves only as a reference.

If you have Cygwin available, you should use it to SSH into your instance. However, if you are using a different computer, you might not have Cygwin at your fingertips. In this case, a lighter-weight SSH client called PuTTY is available for Windows.

You can download PuTTY from: http://www.chiark.greenend.org.uk/~sgtatham/putty/

Amazon provides a great tutorial on how to connect to a virtual machine from Windows.

PuTTY is fairly simple and straight forward with one caveat: Amazon's *.pem files are SSH private key files, and they need to be converted to PuTTY's own .ppk format. To do this, use the puttygen.exe utility available from the same page as PuTTY. Select "Import" under the conversions menu, load the amazon *.pem key file, and press the "Save Private Key" button.

Copy and paste works similarly to the X Window System in Unix. You use the left mouse button to select text in the PuTTY window. The act of selection automatically copies the text to the clipboard: there is no need to press Ctrl-Ins or Ctrl-C or anything else. In fact, pressing Ctrl-C will send a Ctrl-C character to the other end of your connection (just like it does the rest of the time), which may have unpleasant effects. The only thing you need to do, to copy text to the clipboard, is to select it.

To paste the clipboard contents into a PuTTY window, by default you click the right mouse button. If you have a three-button mouse and are used to X applications, you can configure pasting to be done by the middle button instead, but this is not the default because most Windows users don't have a middle button at all.

Here is a good PuTTY tutorial that you might find useful to get started: http://kb.mediatemple.net/questions/1595/Using+SSH+in+Putty+%28Windows%29

SSHFS and SFTP

In addition to just SSH, your SSH server also supports SSHFS, which enables you to mount your remote instance as a disk on your local computer, and SFTP, which is a file transfer protocol that enables you to upload files directly to your instance.

SSHFS

SSHFS is a filesystem client which allows secure mounting of remote file systems. While there are other ways to mount remote file systems, SSHFS has the advantage of being able to mount a file system located on any host that has an SSH daemon running without any host side installation or configuration. This means that you can easily access and edit your files using all of your local applications including IDEs.

As you may have inferred from the name, the underlying implementation utilizes SSH File Transfer Protocol in combination with FUSE, a package now included in the kernel that allows unprivileged users to easily create their own file systems in userspace (see the wikipedia entry for more information [1]).

To mount a share using password based authentication, the command is:

$ sshfs <user>@<domain>:</path/to/remote/directory> </path/to/local/mountpoint>

For example, to mount the directory /home/joe/myfiles in the user joe's home directory for a machine with the domain schmoesfiles.org using SSHFS you would enter the command

$ sshfs joe@www.schmoesfiles.org:myfiles

Note that if you are using public key authentication, the command to mount the remote filesystem may need to be slightly different:

$ sshfs -o IdentityFile=</path/to/private/key> <user>@<domain>:</path/to/remote/directory> </path/to/local/mountpoint>

To unmount the filesystem, you can use the following command:

$ fusermount -u </path/to/local/mountpoint>

SFTP

Any server running an SSH server is also compatible with SFTP or Secure File Transfer Protocol. (Compare to FTP, or File Transfer Protocol.) SFTP is a convenient way to edit files on your computer and then upload them to your server in just a few clicks.