OpenSSL/SSH - Revision history

Hdridder at 09:15, 30 December 2025

2025-12-30T09:15:35Z

← Older revision		Revision as of 09:15, 30 December 2025
Line 1:		Line 1:
	[[Category:Networking]]		[[Category:Networking]]
	[[Category:Linux/Unix]]		[[Category:Linux/Unix]]

			=Files and permissions=
			Files for ssh are by default in ~/.ssh

			SSH is very strict about the permissions on the files to be as secure as possible.
			{\| class="wikitable"
			! style="width:20%"\| Path
			! style="width:20%"\| Permissions
			! style="width:60%"\| Remark
			\|-
			\| ~/.ssh
			\| 700 (-rwx------)
			\| The directory (in your home dir)
			\|-
			\| id_<type>
			\| 600 (-rw-------)
			\| The private key, <type> can be rsa, ed25519, ...
			\|-
			\| id_<type>.pub
			\| 644 (-rw-r--r--)
			\| The public key for the private key of the same <type>
			\|-
			\| authorized_keys
			\| 600 (-rw-------)
			\| The public keys in here can login without password
			\|}

	=key-handling=		=key-handling=
	;ssh-keygen -t ed25519		;ssh-keygen -t ed25519
	:Create a keypair (accept all defaults, put a password if you want)		:Create a keypair in ~/.ssh (accept all defaults, put a password if you want)
	;ssh-keygen -y -f <privatkeyfile>		;ssh-keygen -y -f <privatkeyfile>
	:Print the public key for the private key in <privatkeyfile>		:Print the public key for the private key in <privatkeyfile>
Line 16:		Line 42:

	=ssh commands=		=ssh commands=
	;ssh user@target		;ssh <user>@<target>
	:~~SSH~~ into target system as user, if user is omitted the current username is used		:Ssh into <target> system as <user>, if user is omitted the current username is used

	;ssh -vvv user@target		;ssh -vvv <user>@<target>
	:Be very verbose with debug information		:Be very verbose with debug information
	;ssh -i keyfile user@target		;ssh -i keyfile user@target
	:Use the key in keyfile to connect		:Use the key in keyfile to connect


	=Certificates=		=Certificates=

Hdridder at 13:38, 7 August 2025

2025-08-07T13:38:41Z

@@ Line 1: / Line 1: @@
 [[Category:Networking]]
 ;openssl rsa -text -noout -in id_rsa
 :Print out key attributes (o.a. key length)
@@ Line 7: / Line 15: @@
 :Convert to DER format.
-;ssh-keygen -t ed25519
+=ssh commands=
 ;ssh user@target
 :SSH into target system as user, if user is omitted the current username is used
@@ Line 62: / Line 66: @@
+}
 </syntaxhighlight>

Hdridder at 13:50, 4 May 2025

2025-05-04T13:50:33Z

← Older revision		Revision as of 13:50, 4 May 2025
Line 19:		Line 19:
	;ssh -i keyfile user@target		;ssh -i keyfile user@target
	:Use the key in keyfile to connect		:Use the key in keyfile to connect


			=Certificates=
			For web-servers you can buy a certificate of get one for free from [[letsencrypt]].

			If for some reason you want to have a self signed certificate you can use this
			<syntaxhighlight lang=bash>
			openssl genrsa -out server.key 4096
			openssl req -new -key server.key -out server.csr
			openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.pem
			</syntaxhighlight>

			Now copy the server.pem and the server.key to the location for your web server.

			I used this to make a default server that catches all traffic to port 80 and to 443 to redirect it. If you don't do this nginx will serve the first server it finds in it's configuration. The certificate has no content except for the CN being 'fake'

			<syntaxhighlight lang=text>
			Default server configuration
			#
			server {
			listen 80 default_server;
			listen [::]:80 default_server;

			# SSL configuration
			#
			listen 443 ssl default_server;
			listen [::]:443 ssl default_server;
			ssl_certificate /var/www/tmp/fake.pem;
			ssl_certificate_key /var/www/tmp/fake.key;

			root /var/www/html;

			# Add index.php to the list if you are using PHP
			index index.html index.htm index.nginx-debian.html;

			server_name _;

			location / {
			try_files $uri $uri/ =404;
			}

			}
			</syntaxhighlight>

Hdridder at 13:40, 19 November 2024

2024-11-19T13:40:11Z

← Older revision		Revision as of 13:40, 19 November 2024
Line 11:		Line 11:
	;ssh-keygen -y -f <privatkeyfile>		;ssh-keygen -y -f <privatkeyfile>
	:Print the public key for the private key in <privatkeyfile>		:Print the public key for the private key in <privatkeyfile>

			;ssh user@target
			:SSH into target system as user, if user is omitted the current username is used

			;ssh -vvv user@target
			:Be very verbose with debug information
			;ssh -i keyfile user@target
			:Use the key in keyfile to connect

Hdridder: Hdridder moved page OpenSSL to OpenSSL/SSH: Better covers the content

2020-11-04T19:33:54Z

Hdridder moved page OpenSSL to OpenSSL/SSH: Better covers the content

← Older revision		Revision as of 19:33, 4 November 2020
(No difference)

Hdridder at 07:08, 6 August 2019

2019-08-06T07:08:10Z

← Older revision		Revision as of 07:08, 6 August 2019
Line 6:		Line 6:
	;openssl x509 -outform der -in <pemfile> -out <filename>.der -text		;openssl x509 -outform der -in <pemfile> -out <filename>.der -text
	:Convert to DER format.		:Convert to DER format.

			;ssh-keygen -t ed25519
			:Create a keypair (accept all defaults, put a password if you want)
			;ssh-keygen -y -f <privatkeyfile>
			:Print the public key for the private key in <privatkeyfile>

Hdridder at 13:14, 9 July 2019

2019-07-09T13:14:21Z

← Older revision		Revision as of 13:14, 9 July 2019
Line 3:		Line 3:
	:Print out key attributes (o.a. key length)		:Print out key attributes (o.a. key length)
	;openssl s_client -showcerts -connect <system><nowiki>:</nowiki><port>		;openssl s_client -showcerts -connect <system><nowiki>:</nowiki><port>
	:Get the certificates ~~for a system~~		:Get the certificates available and test connectivity
	;openssl x509 -outform der -in <pemfile> -out <filename>.der -text		;openssl x509 -outform der -in <pemfile> -out <filename>.der -text
	:Convert to DER format.		:Convert to DER format.

Hdridder at 13:12, 12 June 2019

2019-06-12T13:12:46Z

← Older revision		Revision as of 13:12, 12 June 2019
Line 1:		Line 1:
			[[Category:Networking]]
	;openssl rsa -text -noout -in id_rsa		;openssl rsa -text -noout -in id_rsa
	:Print out key attributes (o.a. key length)		:Print out key attributes (o.a. key length)
			;openssl s_client -showcerts -connect <system><nowiki>:</nowiki><port>
			:Get the certificates for a system
			;openssl x509 -outform der -in <pemfile> -out <filename>.der -text
			:Convert to DER format.

Hdridder: Created page with ";openssl rsa -text -noout -in id_rsa :Print out key attributes (o.a. key length)"

2018-02-13T12:59:02Z

Created page with ";openssl rsa -text -noout -in id_rsa :Print out key attributes (o.a. key length)"

New page

;openssl rsa -text -noout -in id_rsa
:Print out key attributes (o.a. key length)