HOWTO: SSH & Public Keys

[jaem]

I pretty much only use SSH for one program (Amarok), so I want to be able to just put a launcher on my desktop with a command like "ssh -X user@192.168.2.10 amarok" and not have to open a terminal and type in a password.My 2 *buntu boxes are on a WEP protected wireless network and my router only forwards a couple hi-end ports for Ktorrent. Is there really a need for me to passphrase-protect my key if i'm only planning on SSHing from my local network?

I'm no expert, but I would say... yes. The only reason I don't is because it's for my Palm (running Angstrom Linux) over a USB connection, and I don't care about it too much. Oh, and if you want to know how secure WEP is, search the Ubuntu repositories for "aircrack". Heck - if I didn't have any moral sense, I'd be messing with my neighbors' computers all the time, encrypted or not!

[splendid]

Any good links to a How To to setup ssh?

[excbuntu]

how can we have bash's ssh client point to a different private key? for example, say i have a private key to use on another computer and i want to use

ssh -L 5900:localhost:5900 pcusingadifferentkey@192.168.1.111

[elitenoobboy]

ssh works properly and all for me, but whatever I do, I can't seem to be able to get the server to use passphrases. It always wants to use passwords instead, even after following the guide.

[C4rlos]

Just a little side note for us newbies to log in to another port:

scp -P 34561 id_dsa.pub serverusername@192.168.1.40:./id_dsa.pub

P < -- Uppercase as opposed to ssh it's lowercase.

[FiVAL]

This is a very good and nice thread about SSH!

Between Ubuntu and Ubuntu it's very easy...
But between my Ubuntu client and my OS X Servers I
can't get SSH with Public (RSA) Keys to work!

Does one of U, here, have an idea?

(see also: http://ubuntuforums.org/showthread.php?t=1540611)

Thx!

[LeFou]

So I've been banging my head against this for awhile. I have an ubuntu server and need passwordless ssh from it to another machine, which runs CentOS. Have tried many times, with two users. Synopsis.

as user1
-I did ssh-keygen, accepted defaults (rsa auth) and gave it a passphrase.
-SCP'd this to a file on machine2
-appended this to authorized_keys2 in .ssh
-logged out of machine2 and did ssh machine2

Result: It prompts me to enter the passphrase for the key.

adding -v shows:

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Next authentication method: publickey
debug1: Trying private key: /home/user1/.ssh/identity
debug1: Offering public key: /home/user1/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug1: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>

If I enter the key's passphrase, it *does ssh without prompting for the remote machine password, but this is not an improvement for me. I want not to be prompted for anything. Someone said "ssh-add" would help but it just says "Could not open a connection to your authentication agent."

as user2
-same ssh-keygen, but without passphrase
-SCP'd this to machine 2 and appended it to authorized_keys2 as above
-logged out and did ssh machine2

Result: It prompts me to enter the password for this user on machine2.

with -v shows:

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Next authentication method: publickey
debug1: Trying private key: /home/user2/.ssh/identity
debug1: Offering public key: /home/inuser2nerecho/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Trying private key: /home/user2/.ssh/id_dsa
debug1: Next authentication method: password

Since both the half-working and not-working ones have the same "Unspecified GSS failure" I don't think that's the problem.