Setting Up An SSH Certificate For Ubuntu From A Mac

This howto should help you with setting up an RSA public and private key setup from a Mac to an Ubuntu box. Of course, this should be possible with other OS's but I have not tested it. Please post if it was useful!

For the past week I have been trying to set up an RSA SSH certificate for accessing my Ubuntu servers from PuTTY and Mac's SSH through a terminal. However I have been faced with some serious problems, thankfully the guys over at ubuntuforums.org could help me out. So here is a quick howto I wrote so that people don't have the same kind of trouble that I did.

Just to clear things up an SSH key is a way to secure your connection to SSH. By using a key you make one private and one public key that sort of match each other. You put the public key on the server and then use your private key to unlock it. It's a type of encryption.

First off lets start with making the key on a Mac:

Open up a terminal (Macintosh HD > Applications > Utilities > Terminal).

Now you can make a few different bit lengths (which is the how secure the key is). I think 2048 should be adequate, but you can put anything you would like.

So type the following to begin the process:

ssh-keygen -t rsa -b 2048

ssh-keygent -t rsa -b 4096

(whichever amount of security you prefer.)

You will then be prompted for a few questions.

Enter file in which to save the key (/home/username/.ssh/id_rsa): (Hit Enter)

This is the default place where the key is stored, keep it here so that you don't have to tell the computer where to find the key.

Enter passphrase (empty for no passphrase):

Please put in a passphrase, if you do not that means if the key gets out anyone can use it WITHOUT ANY PASSWORDS!

Enter same passphrase again:

After this your computer now has the public and private key pair in your computer. Now we have to put the public key onto the server.

While still in the terminal type the following:

nano /Users/YOURUSERNAMEHERE/.ssh/id_rsa.pub

This is a in terminal text editor, first off copy all of the text in that file, and then press ctrl + x to exit out of the editor. Once this is done SSH into your server.

Now navigate to your terminal or command prompt on the Ubuntu server and type the following:

nano /home/YOURUSERNAMEHERE/.ssh/authorized_keys

From here you can paste the data from the public key generated on your Mac. Make sure that it all fits onto one line.

Now test out your connection to make sure that it works from your mac, if all went well you should be prompted for the passphrase for the key.

Now the following steps are optional, these will make it so that all you can do is log in via a private key, this means you will no longer be able to use your username and password to log in.

sudo nano /etc/ssh/sshd_config

Make sure that the following settings are as shown:

RSAAuthentication yes 
PubkeyAuthentication yes
PasswordAuthentication no
UsePAM no

view as pdf | print

Share this page:

10 Comment(s)

Add comment

Comments

By: onion

This line:

Once this is done SSH into your server.

I'm wondering how one could do this.......if it hasn't been set up yet.

That's like saying:

1) remove gasoline from car

2) work on engine

3) start car

How do we do #3? There's no gas in there.

By: Anonymous

that's a poor analogy. Also it assumes you have ssh access to the server in the first place. If you don't this won't help you. This is not a way AROUND security, it's a way to implement better security.

By: RC3

yes onion, bad analogy. This works very well. You must allready have ssh set up with passwords to follow this step by step. If you dont you will have to upload the .pub file and copy its contents to authorized_keys. Then turn off password auth.

Thanks howtoforge........

By: Ubuntu user

Thanks a lot!

This is exactly what I was searching for, and it worked!

Greetz

By: Adam M. Erickson

Don't listen to all the negative comments.

You were at the top of my google search and it worked.

I perfer to use vi editor but that is just a preference of mine.

For others reading, if you are sick of being prompted for the remote root password because you ssh into 20 different servers a day this is very helpful indeed.

By: dahlgren

Thanks for posting this! It's straight forward and helpful.

By: Anonymous

This page should be re-titled as these are not certificates. These are ssh PSK(pre-shared keys). Certificates have chains of authority signed by root CA, etc.

By:

Good quick tutorial, I have used it many times.

I just want to point out a typo though:

ssh-keygent -t rsa -b 4096

"ssh-keygen" not "ssh-keygent"

By: Paxoria

You don't explain what computer's user name to use. The server or the client?

By: thekid

You said save the RSA key in /home/username/.ssh/id_rsa but on MacOS your home directory is in /Users, not /home.

Log in or Sign up

On this page