View source for OpenSSL/SSH

[[Category:Networking]]
[[Category:Linux/Unix]]
 
=Files and permissions=
Files for ssh are by default in ~/.ssh

SSH is very strict about the permissions on the files to be as secure as possible.
{| class="wikitable"
! style="width:20%"| Path
! style="width:20%"| Permissions
! style="width:60%"| Remark
|-
| ~/.ssh
| 700 (-rwx------)
| The directory (in your home dir)
|-
| id_<type>
| 600 (-rw-------)
| The private key, <type> can be rsa, ed25519, ...
|-
| id_<type>.pub
| 644 (-rw-r--r--)
| The public key for the private key of the same <type>
|-
| authorized_keys
| 600 (-rw-------)
| The public keys in here can login without password
|}

=key-handling=
;ssh-keygen -t ed25519
:Create a keypair in ~/.ssh (accept all defaults, put a password if you want)
;ssh-keygen -y -f <privatkeyfile>
:Print the public key for the private key in <privatkeyfile>

;openssl rsa -text -noout -in id_rsa
:Print out key attributes (o.a. key length)
;openssl s_client -showcerts -connect <system><nowiki>:</nowiki><port>
:Get the certificates available and test connectivity
;openssl x509 -outform der -in <pemfile> -out <filename>.der -text
:Convert to DER format.

=ssh commands=
;ssh <user>@<target>
:Ssh into <target> system as <user>, if user is omitted the current username is used
 
;ssh -vvv <user>@<target>
:Be very verbose with debug information
;ssh -i keyfile user@target
:Use the key in keyfile to connect

=Certificates=
For web-servers you can buy a certificate of get one for free from [[letsencrypt]].

If for some reason you want to have a self signed certificate you can use this
<syntaxhighlight lang=bash>
openssl genrsa  -out server.key 4096
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.pem
</syntaxhighlight>

Now copy the server.pem and the server.key to the location for your web server.

I used this to make a default server that catches all traffic to port 80 and to 443 to redirect it. If you don't do this nginx will serve the first server it finds in it's configuration. The certificate has no content except for the CN being 'fake'

<syntaxhighlight lang=text>
Default server configuration
#
server {
	listen 80 default_server;
	listen [::]:80 default_server;

	# SSL configuration
	#
	listen 443 ssl default_server;
	listen [::]:443 ssl default_server;
    ssl_certificate      /var/www/tmp/fake.pem;
    ssl_certificate_key  /var/www/tmp/fake.key;

    root /var/www/html;

	# Add index.php to the list if you are using PHP
	index index.html index.htm index.nginx-debian.html;

	server_name _;

	location / {
		try_files $uri $uri/ =404;
	}

}
</syntaxhighlight>

=ssh-agent=
ssh-agent can store private keys in memory unencrypted. The private key passphrase only needs to be provided when the key is uploaded to the agent.

;eval "$(ssh-agent)"
:Start a ssh-agent by evaluating the commands generated by ssh-agent
:;ssh-agent
::Generate the commands to start a ssh-agent. Output looks like:
  SSH_AUTH_SOCK=/tmp/ssh-wBZcxqiOp6co/agent.61466; export SSH_AUTH_SOCK;
  SSH_AGENT_PID=61467; export SSH_AGENT_PID;
  echo Agent pid 61467;
:The agent is not stopped when the user logs out. The agent can be accessed again by setting the environment variables as above.

;killall ssh-agent
:Stop all ssh-agent processes you can (of not root this mean your own.

;ssh-add <private key file>
:Add the key to the agent, it asks for the passphrase if that is required
;ssh-add -l
:List the keys currently in the agent