Many times it is useful to keys to authenticate to your servers. This can dramatically improve security and is a great way to manage servers in bulk as well. You just need to keep track of your keys rather than having to remember a large number of passwords. The steps to get PEM key authentication are fairly straight forward but it never hurts to walk through the process of getting them set up correctly.
Side Note: I’d like to also mention briefly, that I have these steps set up to work with Chef, so every server that gets deployed using Chef will use PEM keys out of the box, which works out very nicely. If you’re interested I can expound on that topic a little more, just let me know.
The first step in the process is to generate some keys using openssl. If you don’t have openssl go download and install it. If you do have openssl but haven’t updated in ahwile, please update to avoid the heartbleed vulnerability that was recently exploited (nearly all distributors have released the patched version at this point so it should be trivial).
We want to generate our key and create a PEM file out of it. Here are the steps:
cd ~/.ssh ssh-keygen -t dsa -b 1024 openssl dsa -in id_dsa -outform pem > test.pem cat ida_dsa >> authorized_keys
You can leave the values blank (default) in the ssh-keygen.
Now you should have similar listings in your ~/.ssh directory:
- authorized_keys – This is the public key that the pem file gets authenticated against
- id_dsa – This is the private portion of the key that we generated in the steps above
- id_dsa.pub – This is the public key section that is used when authenticating
- test.pem – this is the file that will be used to authenticate. Essentially the private key minus the pass phrase
Now you just need to copy the test.pem file that was just generated to a different host in order to log in with your PEM key using scp or rsync. Once that is done, the command to connect to the remote host using your key should look similar to the following:
ssh -i /path/to/pem user@server-name
Next steps. At this point you should have a working pem authentication on your server. It is probably a good idea at this point to start looking at hardening the security as well as the SSH configuration on the host. Small things can go a long way. For example disabling root login, disabling password authentication, etc. will stop a very large amount of attacks from hitting your server now that you are authenticating with pem keys.
