| 1 |
<?xml version='1.0' encoding="UTF-8"?>
|
| 2 |
<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
|
| 3 |
|
| 4 |
<!DOCTYPE guide SYSTEM "/dtd/guide.dtd">
|
| 5 |
|
| 6 |
<guide link = "/proj/en/infrastructure/cvs-sshkeys.xml">
|
| 7 |
<title>SSH access to cvs.gentoo.org</title>
|
| 8 |
<author title="Author">
|
| 9 |
<mail link="swift@gentoo.org">Sven Vermeulen</mail>
|
| 10 |
</author>
|
| 11 |
<author title="Author">
|
| 12 |
<mail link="robbat2@gentoo.org">Robin H. Johnson</mail>
|
| 13 |
</author>
|
| 14 |
<abstract>
|
| 15 |
This mini-guide explains on how to create and use ssh-keys, especially
|
| 16 |
for use on cvs.gentoo.org.
|
| 17 |
</abstract>
|
| 18 |
<version>1.1</version>
|
| 19 |
<date>2007/12/24</date>
|
| 20 |
|
| 21 |
<chapter>
|
| 22 |
<title>SSH keys</title>
|
| 23 |
<section>
|
| 24 |
<title>Creating the SSH keys</title>
|
| 25 |
<body>
|
| 26 |
<p>
|
| 27 |
First of all, be physically logged on to your own computer. Make sure
|
| 28 |
that no-one will see you typing stuff in, since we are going to type in
|
| 29 |
passphrases and such. So get your pepperspray and fight all untrusted
|
| 30 |
entities until you are home alone.
|
| 31 |
</p>
|
| 32 |
<p>
|
| 33 |
Now we are going to create our ssh keys, DSA keys to be exact. Log onto
|
| 34 |
your computer as the user that you are going to be using when you want
|
| 35 |
to access cvs.gentoo.org. Then issue <c>ssh-keygen -t dsa</c>:
|
| 36 |
</p>
|
| 37 |
<pre caption = "Creating SSH keys">
|
| 38 |
$ <i>ssh-keygen -t dsa</i>
|
| 39 |
Generating public/private dsa key pair.
|
| 40 |
Enter file in which to save the key (/home/temp/.ssh/id_dsa): <comment>(Press enter)</comment>
|
| 41 |
Created directory '/home/temp/.ssh'.
|
| 42 |
Enter passphrase (empty for no passphrase): <comment>(Enter your passphrase)</comment>
|
| 43 |
Enter same passphrase again: <comment>(Enter your passphrase again)</comment>
|
| 44 |
Your identification has been saved in /home/temp/.ssh/id_dsa.
|
| 45 |
Your public key has been saved in /home/temp/.ssh/id_dsa.pub.
|
| 46 |
The key fingerprint is:
|
| 47 |
85:35:81:a0:87:56:78:a2:da:53:6c:63:32:d1:34:48 temp@Niandra
|
| 48 |
</pre>
|
| 49 |
<note>
|
| 50 |
Please be sure to set a strong passphrase on your private key. Ideally,
|
| 51 |
this passphrase should be at least 8 characters and contain a mixture of
|
| 52 |
letters, numbers and symbols.
|
| 53 |
</note>
|
| 54 |
<p>
|
| 55 |
Now wasn't that easy? Let's see what we have created:
|
| 56 |
</p>
|
| 57 |
<pre caption = "Created files">
|
| 58 |
# <i>ls ~/.ssh</i>
|
| 59 |
id_dsa id_dsa.pub
|
| 60 |
</pre>
|
| 61 |
<p>
|
| 62 |
You'll probably have more files than this, but the 2 files listed above
|
| 63 |
are the ones that are really important.
|
| 64 |
</p>
|
| 65 |
<p>
|
| 66 |
The first file, <path>id_dsa</path>, is your <e>private</e> key. Don't
|
| 67 |
distribute this amongst all people unless you want to get into a fight
|
| 68 |
with drobbins (no, you don't want that).
|
| 69 |
</p>
|
| 70 |
<warn>
|
| 71 |
If you have several (<e>trusted!</e>) hosts from which you want to
|
| 72 |
connect to cvs.gentoo.org, you should copy <path>id_dsa</path> to the
|
| 73 |
<path>~/.ssh</path> directories on those hosts.
|
| 74 |
</warn>
|
| 75 |
<p>
|
| 76 |
The second file, <path>id_dsa.pub</path>, is your <e>public</e> key.
|
| 77 |
Distribute this file amongst all hosts that you want to be able to
|
| 78 |
access through SSH pubkey authentification. This file should be appended
|
| 79 |
to <path>~/.ssh/authorized_keys</path> on those remote hosts. Also add it
|
| 80 |
to your local host so you can connect to that one too if you have several
|
| 81 |
boxes.
|
| 82 |
</p>
|
| 83 |
<pre caption = "Adding the SSH key to the box">
|
| 84 |
$ <i>cat ~/.ssh/id_dsa.pub >> ~/.ssh/authorized_keys</i>
|
| 85 |
</pre>
|
| 86 |
</body>
|
| 87 |
</section>
|
| 88 |
<section>
|
| 89 |
<title>Installing your public key on a machine using LDAP authentication for SSH</title>
|
| 90 |
<body>
|
| 91 |
<p>
|
| 92 |
For most of the Gentoo infrastructure, we use LDAP to distribute user
|
| 93 |
information including SSH public keys. On these machines,
|
| 94 |
<path>~/.ssh/authorized_keys</path> should generally not contain your key.
|
| 95 |
</p>
|
| 96 |
<p>
|
| 97 |
Instead, you should place your public key into LDAP, using
|
| 98 |
<path>perl_ldap</path>, or <path>ldapmodify</path> directly.
|
| 99 |
The Infrastructure <uri link="/proj/en/infrastructure/ldap.xml">LDAP
|
| 100 |
guide</uri> describes this in more detail.
|
| 101 |
</p>
|
| 102 |
<pre caption = "Adding the SSH key with perl_ldap on dev.gentoo.org">
|
| 103 |
$ <i>perl_ldap -b user -C sshPublicKey "$(cat ~/.ssh/id_dsa.pub)" <username></i>
|
| 104 |
</pre>
|
| 105 |
<warn>Each <path>sshPublicKey</path> attribute must contain exactly one public key. If you have multiple public keys, you must have multiple attributes!</warn>
|
| 106 |
</body>
|
| 107 |
</section>
|
| 108 |
<section>
|
| 109 |
<title>Using keychain</title>
|
| 110 |
<body>
|
| 111 |
<p>
|
| 112 |
Every time you want to log on to a remote host using SSH public key
|
| 113 |
authentification, you will be asked to enter your passphrase. As much as
|
| 114 |
everybody likes typing, too much is sometimes too much. Luckily,
|
| 115 |
there is <c>keychain</c> to the rescue. There is an document on this
|
| 116 |
one <uri link="/proj/en/keychain.xml">here</uri>,
|
| 117 |
but I'll give you a quick introduction.
|
| 118 |
</p>
|
| 119 |
<p>
|
| 120 |
First, install <c>keychain</c>:
|
| 121 |
</p>
|
| 122 |
<pre caption = "Installing keychain">
|
| 123 |
# <i>emerge keychain</i>
|
| 124 |
</pre>
|
| 125 |
<p>
|
| 126 |
Now have keychain load up your private ssh key when you log on to your
|
| 127 |
local box. To do so, add the following to <path>~/.bash_profile</path>.
|
| 128 |
Again, this should be done on your <e>local</e> machine where you work
|
| 129 |
at the Gentoo CVS.
|
| 130 |
</p>
|
| 131 |
<pre caption = "Add this to .bash_profile">
|
| 132 |
keychain ~/.ssh/id_dsa
|
| 133 |
. .keychain/<comment>hostname</comment>-sh
|
| 134 |
</pre>
|
| 135 |
<p>
|
| 136 |
Be sure to substitute <c>hostname</c> with your hostname.
|
| 137 |
</p>
|
| 138 |
</body>
|
| 139 |
</section>
|
| 140 |
</chapter>
|
| 141 |
</guide>
|
Parent Directory
| 
Revision Log