Différences
Ci-dessous, les différences entre deux révisions de la page.
|
en:documentation:tutorials:ssh:clef_agent_ssh [2018/05/28 16:20] cpetit [Diffuser la clef publique] |
en:documentation:tutorials:ssh:clef_agent_ssh [2020/08/25 17:58] |
||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| - | <WRAP center round todo 60%> | ||
| - | Translation in progress... | ||
| - | </WRAP> | ||
| - | ====== Use SSK keys and SSH agent ====== | ||
| - | |||
| - | Most oftenly, the SSH client is used with a pair ''[user + password]'' to connect to a remote machine.ne distante. | ||
| - | |||
| - | However, it is possible to use keys | ||
| - | (authentication via private/public key pair, \\ see [[https://en.wikipedia.org/wiki/Public-key_cryptography|here]]) | ||
| - | to connect to a remote server. \\ Moreover, using an SSH agent, you can avoid typing passwords. | ||
| - | |||
| - | ===== Generate a set of key ===== | ||
| - | |||
| - | To generate your personal key set, use the same commands as the one to generate the [[en:documentation:tutorials:ssh:first_connection|PSMN internal key ]] . | ||
| - | |||
| - | <note important>**IMPORTANT STEP ADDED** : define a passphrase to lock your private key.</note> | ||
| - | |||
| - | For Windows users, [[documentation:tutorials:ssh:putty|relate to the PuTTY documentation]]. | ||
| - | |||
| - | For Linux, BSD et MacOS X, here are the main steps to follow: | ||
| - | |||
| - | ==== Step 1 : Start generating a set of keys ==== | ||
| - | |||
| - | In a ''Terminal'' type the following commands: | ||
| - | |||
| - | <code bash> | ||
| - | user@host:~$ ssh-keygen | ||
| - | Generating public/private rsa key pair. | ||
| - | Enter file in which to save the key (/home/user/.ssh/id_rsa): | ||
| - | <Appuyer la touche Enter> | ||
| - | Created directory '/home/user/.ssh'. | ||
| - | Enter passphrase (empty for no passphrase): | ||
| - | </code> | ||
| - | |||
| - | ==== Step 2 : Choose a good/strong passphrase ==== | ||
| - | |||
| - | The passphrase is important, it locks your private key. A good passphrase must include ** at least 15 characters **. | ||
| - | |||
| - | This is a **bad passphrase** : | ||
| - | <code> | ||
| - | toto | ||
| - | </code> | ||
| - | |||
| - | If the passphrase is too short or too poor, the program will answer: | ||
| - | <code bash> | ||
| - | Enter same passphrase again: | ||
| - | passphrase too short: have 4 bytes, need > 4 | ||
| - | Saving the key failed: /home/user/.ssh/id_rsa. | ||
| - | </code> | ||
| - | |||
| - | **failed...** | ||
| - | |||
| - | This is a **good passphrase** : | ||
| - | <code> | ||
| - | V0ici 1 ex3mple de passphrase c0mpl1quée, v0ire, alambiquée. | ||
| - | </code> | ||
| - | |||
| - | This is also an example of a **good passphrase** : | ||
| - | <code> | ||
| - | A bottle of "Glenfîddich Rare Collection 1937" cost 15 000 euros VAT. Minimum... | ||
| - | </code> | ||
| - | |||
| - | ==== Step 3: Finish the keyset generation ==== | ||
| - | |||
| - | Finally ''ssh-keygen'' says: | ||
| - | <code bash> | ||
| - | Enter same passphrase again: | ||
| - | Your identification has been saved in /home/user/.ssh/id_rsa. | ||
| - | Your public key has been saved in /home/user/.ssh/id_rsa.pub. | ||
| - | </code> | ||
| - | |||
| - | A fingerprint is also generated (see below): | ||
| - | |||
| - | <code bash> | ||
| - | The key fingerprint is: | ||
| - | 7a:ec:b2:1c:90:f5:2f:77:c5:bc:36:8b:0f:23:2e:76 user@host | ||
| - | The key's randomart image is: | ||
| - | +--[ RSA 2048]----+ | ||
| - | | | | ||
| - | | | | ||
| - | | . | | ||
| - | | o . o | | ||
| - | | o S + | | ||
| - | | . o . . . | | ||
| - | | o + + + + | | ||
| - | | ..+o+Eo = o | | ||
| - | | o+.o. ..o | | ||
| - | +-----------------+ | ||
| - | </code> | ||
| - | |||
| - | ==== Step 4: Save your ssh key set ==== | ||
| - | |||
| - | You can copy/paste the fingerprint verification (fingerprint + image) into a file '' ~ / .ssh / fingerprint ''. | ||
| - | |||
| - | **Save** your private key (''id_rsa''), your fingerprint file (''fingerprint'') and your public key (''id_rsa.pub''), in a safe and personal place (a USB key, for example). | ||
| - | ===== Load agent-ssh ===== | ||
| - | |||
| - | ==== Linux / BSD ==== | ||
| - | |||
| - | Il existe tout un tas de méthodes : | ||
| - | |||
| - | * Utiliser les programmes ''ssh-askpass'' ou ''ssh-askpass-gnome'' de votre distribution favorite... | ||
| - | * charger l'agent dans un script : | ||
| - | |||
| - | <code bash> | ||
| - | eval `ssh-agent` | ||
| - | ssh-add | ||
| - | </code> | ||
| - | |||
| - | * Installer et utiliser [[http://www.funtoo.org/wiki/Keychain|keychain]] (outil CLI, prendre l'archive Release). | ||
| - | |||
| - | Vous pouvez utiliser un script (dans votre ''~/.bashrc'') pour le démarrer, et l'utiliser automatiquement dans vos terminaux : | ||
| - | <code bash> | ||
| - | # add key(s) to agent | ||
| - | eval `keychain --eval --agents ssh id_rsa` | ||
| - | </code> | ||
| - | |||
| - | ==== MacOS X ==== | ||
| - | |||
| - | Sur MacOS X, il existe aussi différentes méthodes : | ||
| - | |||
| - | * Installer et utiliser [[http://www.funtoo.org/wiki/Keychain|keychain]] (outil CLI, prendre le package pour MacOS X). | ||
| - | |||
| - | Vous pouvez utiliser un script (dans votre ''~/.bashrc'') pour le démarrer, et l'utiliser automatiquement dans Terminal : | ||
| - | <code bash> | ||
| - | # add key(s) to agent | ||
| - | eval `keychain --eval --agents ssh id_rsa` | ||
| - | </code> | ||
| - | |||
| - | * Si vous utilisez MacOSX Keychain, ajoutez l'option ''--inherit any'' : | ||
| - | <code bash> | ||
| - | # add key(s) to agent | ||
| - | eval `keychain --eval --agents ssh --inherit any id_rsa` | ||
| - | </code> | ||
| - | |||
| - | <note important>Si, à chaque ouverture de Terminal, keychain demande votre passphrase, enlevez l'option ''--inherit any''</note> | ||
| - | |||
| - | * Installer et utiliser [[http://sshkeychain.sourceforge.net/|SSHKeyChain]] (outil graphique) | ||
| - | |||
| - | |||
| - | <note tip>Pour bénéficier de "l'export X", il faut aussi démarrer le serveur X sur le Mac, voir [[documentation:tutorials:ssh:clef_agent_ssh#export_x_pour_macos_x|X11 et MacOS X]]</note> | ||
| - | |||
| - | |||
| - | |||
| - | ==== Windows ==== | ||
| - | |||
| - | Sur Windows, il faut utiliser le logiciel PuTTY, dont l'usage est expliqué [[documentation:tutorials:ssh:putty|sur cette page]]. | ||
| - | |||
| - | ===== Broadcast the public key ===== | ||
| - | |||
| - | For the automatic loggin to work (//ie//: without password, ** but with passphrase **), your public key (id_rsa.pub) must be on all target servers, in the ''~ /.ssh /authorized_keys'' file. | ||
| - | |||
| - | * At PSMN, simply do as below (your ''/home'' is shared between all front nodes and compute nodes): | ||
| - | |||
| - | <code bash> | ||
| - | scp ~/.ssh/id_rsa.pub yourlogin@allo-psmn:~/.ssh/authorized_keys | ||
| - | |||
| - | yourlogin@allo-psmn's password: | ||
| - | id_rsa.pub 100% 9KB 9.3KB/s 00:00 | ||
| - | </code> | ||
| - | |||
| - | <note important>This **erase** the existing ''~/.ssh/authorized_keys'' file. To simply **add** your public key to the existing''~/.ssh/authorized_keys'' file, use the following commands:</note> | ||
| - | |||
| - | <code bash> | ||
| - | scp ~/.ssh/id_rsa.pub yourlogin@allo-psmn:~/.ssh/id_rsa.pub | ||
| - | yourlogin@allo-psmn's password: | ||
| - | id_rsa.pub 100% 9KB 9.3KB/s 00:00 | ||
| - | </code> | ||
| - | |||
| - | <code bash> | ||
| - | ssh yourlogin@allo-psmn | ||
| - | yourlogin@allo-psmn's password: | ||
| - | |||
| - | > cat .ssh/id_rsa.pub >> .ssh/authorized_keys | ||
| - | > exit | ||
| - | </code> | ||
| - | |||
| - | If you have successfully loaded your ssh-agent, you can now login to '' allo-psmn '' without providing your password: | ||
| - | |||
| - | <code bash> | ||
| - | user@host:~$ ssh yourlogin@allo-psmn.ens-lyon.fr | ||
| - | </code> | ||
| - | (yourlogin correspond to your login at PSMN) | ||
| - | |||
| - | ===== Exemples et Cas particuliers ===== | ||
| - | |||
| - | ==== Exemple de configuration pour Linux et BSD==== | ||
| - | |||
| - | On peut automatiser les étapes de la connexion en utilisant le fichier ''config'' de SSH sur votre poste de travail. En voici un exemple : | ||
| - | |||
| - | * ''~/.ssh/config'' **pour Linux ou BSD** | ||
| - | |||
| - | <code bash config> | ||
| - | Host * | ||
| - | ServerAliveInterval 60 | ||
| - | ForwardX11Timeout 1d | ||
| - | TCPKeepAlive yes | ||
| - | ForwardAgent yes | ||
| - | ForwardX11 yes # pour Linux | ||
| - | # ForwardX11Trusted yes # pour MacOSX | ||
| - | Compression yes | ||
| - | StrictHostKeyChecking no | ||
| - | HashKnownHosts no | ||
| - | |||
| - | ### | ||
| - | # passerelle interne | ||
| - | Host allo-psmn | ||
| - | User <login PSMN> | ||
| - | HostName allo-psmn.psmn.ens-lyon.fr | ||
| - | |||
| - | # connexion à x5650comp1 depuis l'interieur de l'ENS | ||
| - | Host comp1 | ||
| - | User <login PSMN> | ||
| - | Hostname x5650comp1 | ||
| - | ProxyCommand ssh <login PSMN>@allo-psmn netcat -w1 %h %p | ||
| - | |||
| - | # connexion à e5-2670comp2 depuis l'interieur de l'ENS | ||
| - | Host comp2 | ||
| - | User <login PSMN> | ||
| - | Hostname e5-2670comp2 | ||
| - | ProxyCommand ssh <login PSMN>@allo-psmn netcat -w1 %h %p | ||
| - | |||
| - | ### | ||
| - | # passerelle externe | ||
| - | Host allo-externe | ||
| - | User <login PSMN> | ||
| - | ProxyCommand ssh <login PSMN>@ssh.psmn.ens-lyon.fr tcpconnect allo-psmn %p | ||
| - | # User <login ENS> | ||
| - | # ProxyCommand ssh <login ENS>@ssh.ens-lyon.fr tcpconnect allo-psmn %p | ||
| - | |||
| - | # connexion à x5650comp1 depuis l'exterieur de l'ENS | ||
| - | Host comp1-ext | ||
| - | User <login PSMN> | ||
| - | HostName x5650comp1 | ||
| - | ProxyCommand ssh <login PSMN>@allo-externe netcat -w1 %h %p | ||
| - | |||
| - | # connexion à e5-2670comp2 depuis l'exterieur de l'ENS | ||
| - | Host comp2-ext | ||
| - | User <login PSMN> | ||
| - | Hostname e5-2670comp2 | ||
| - | ProxyCommand ssh <login PSMN>@allo-externe netcat -w1 %h %p | ||
| - | |||
| - | </code> | ||
| - | |||
| - | Bien évidemment, il faut remplacer ''<login PSMN>'' par votre login du PSMN, et ''<login ENS>'' par votre login de l'ENS. ''netcat -w1'' peut être remplacé par ''tcpconnect''. | ||
| - | |||
| - | La liste des serveurs de connexion du PSMN est disponible [[documentation:clusters:services#serveurs_de_compilation|sur cette page]]. | ||
| - | |||
| - | Ce fichier contient déjà des rebonds. Pour plus d'explication, la documentation sur les rebonds et leur automatisation est disponible [[documentation:tutorials:ssh:multihop_ssh|sur cette page]]. | ||
| - | |||
| - | ==== Exemple de configuration pour MacOS X ==== | ||
| - | |||
| - | Sur MacOS X, il vaut mieux utiliser l'option ''-Y'' au lieu de ''-X'' (ou ''ForwardX11Trusted yes'' au lieu de ''ForwardX11 yes'' dans votre fichier ''~/.ssh/config''). En voici un exemple : | ||
| - | |||
| - | * ''~/.ssh/config'' **pour MacOS X** | ||
| - | |||
| - | <code bash config> | ||
| - | Host * | ||
| - | ServerAliveInterval 60 | ||
| - | ForwardX11Timeout 1d | ||
| - | TCPKeepAlive yes | ||
| - | ForwardAgent yes | ||
| - | # ForwardX11 yes # pour Linux | ||
| - | ForwardX11Trusted yes # pour MacOSX | ||
| - | Compression yes | ||
| - | StrictHostKeyChecking no | ||
| - | HashKnownHosts no | ||
| - | |||
| - | ### | ||
| - | # passerelle interne | ||
| - | Host allo-psmn | ||
| - | User <login PSMN> | ||
| - | HostName allo-psmn.psmn.ens-lyon.fr | ||
| - | |||
| - | # connexion à x5650comp1 depuis l'interieur de l'ENS | ||
| - | Host comp1 | ||
| - | User <login PSMN> | ||
| - | Hostname x5650comp1 | ||
| - | ProxyCommand ssh <login PSMN>@allo-psmn netcat -w1 %h %p | ||
| - | |||
| - | # connexion à e5-2670comp2 depuis l'interieur de l'ENS | ||
| - | Host comp2 | ||
| - | User <login PSMN> | ||
| - | Hostname e5-2670comp2 | ||
| - | ProxyCommand ssh <login PSMN>@allo-psmn netcat -w1 %h %p | ||
| - | |||
| - | ### | ||
| - | # passerelle externe | ||
| - | Host allo-externe | ||
| - | User <login PSMN> | ||
| - | #HostName allo-psmn | ||
| - | ProxyCommand ssh <login PSMN>@ssh.psmn.ens-lyon.fr tcpconnect allo-psmn %p | ||
| - | |||
| - | # connexion à x5650comp1 depuis l'exterieur de l'ENS | ||
| - | Host comp1-ext | ||
| - | User <login PSMN> | ||
| - | HostName x5650comp1 | ||
| - | ProxyCommand ssh <login PSMN>@allo-externe netcat -w1 %h %p | ||
| - | |||
| - | # connexion à e5-2670comp2 depuis l'exterieur de l'ENS | ||
| - | Host comp2-ext | ||
| - | User <login PSMN> | ||
| - | Hostname e5-2670comp2 | ||
| - | ProxyCommand ssh <login PSMN>@allo-externe netcat -w1 %h %p | ||
| - | |||
| - | </code> | ||
| - | |||
| - | Bien évidemment, il faut remplacer ''<login PSMN>'' par votre login au PSMN. ''netcat -w1'' peut être remplacé par ''tcpconnect''. | ||
| - | |||
| - | La liste des serveurs de connexion du PSMN est disponible [[documentation:clusters:services#serveurs_de_compilation|sur cette page]] | ||
| - | |||
| - | Ce fichier contient déjà des rebonds. Pour plus d'explication, la documentation sur les rebonds et leur automatisation est disponible [[documentation:tutorials:ssh:multihop_ssh|sur cette page]]. | ||
| - | |||
| - | ==== export X pour MacOS X ==== | ||
| - | |||
| - | Pour pouvoir utiliser "l'export X" sur un Mac, il faut démarrer le logiciel X11 (dans Applications/Utilitaires, comme Terminal) avant d'initier une connexion SSH. | ||
| - | |||
| - | ==== Rebonds et multiples rebonds ==== | ||
| - | |||
| - | Pour plus d'explication, la documentation sur les rebonds et leur automatisation est disponible [[documentation:tutorials:ssh:multihop_ssh|sur cette page]]. | ||