OpenSSL/SSH

Files and permissions

Files for ssh are by default in ~/.ssh

SSH is very strict about the permissions on the files to be as secure as possible.

Path	Permissions	Remark
~/.ssh	700 (-rwx------)	The directory (in your home dir)
id_<type>	600 (-rw-------)	The private key, <type> can be rsa, ed25519, ...
id_<type>.pub	644 (-rw-r--r--)	The public key for the private key of the same <type>
authorized_keys	600 (-rw-------)	The public keys in here can login without password

key-handling

ssh-keygen -t ed25519

Create a keypair in ~/.ssh (accept all defaults, put a password if you want)

ssh-keygen -y -f <privatkeyfile>

Print the public key for the private key in <privatkeyfile>

openssl rsa -text -noout -in id_rsa

Print out key attributes (o.a. key length)

openssl s_client -showcerts -connect <system>:<port>

Get the certificates available and test connectivity

openssl x509 -outform der -in <pemfile> -out <filename>.der -text

Convert to DER format.

ssh commands

ssh <user>@<target>

Ssh into <target> system as <user>, if user is omitted the current username is used

ssh -vvv <user>@<target>

Be very verbose with debug information

ssh -i keyfile user@target

Use the key in keyfile to connect

Certificates

For web-servers you can buy a certificate of get one for free from letsencrypt.

If for some reason you want to have a self signed certificate you can use this

openssl genrsa  -out server.key 4096
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.pem

Now copy the server.pem and the server.key to the location for your web server.

I used this to make a default server that catches all traffic to port 80 and to 443 to redirect it. If you don't do this nginx will serve the first server it finds in it's configuration. The certificate has no content except for the CN being 'fake'

Default server configuration
#
server {
	listen 80 default_server;
	listen [::]:80 default_server;

	# SSL configuration
	#
	listen 443 ssl default_server;
	listen [::]:443 ssl default_server;
    ssl_certificate      /var/www/tmp/fake.pem;
    ssl_certificate_key  /var/www/tmp/fake.key;

    root /var/www/html;

	# Add index.php to the list if you are using PHP
	index index.html index.htm index.nginx-debian.html;

	server_name _;

	location / {
		try_files $uri $uri/ =404;
	}

}

ssh-agent

ssh-agent can store private keys in memory unencrypted. The private key passphrase only needs to be provided when the key is uploaded to the agent.

eval "$(ssh-agent)"

Start a ssh-agent by evaluating the commands generated by ssh-agent

ssh-agent

Generate the commands to start a ssh-agent. Output looks like:

 SSH_AUTH_SOCK=/tmp/ssh-wBZcxqiOp6co/agent.61466; export SSH_AUTH_SOCK;
 SSH_AGENT_PID=61467; export SSH_AGENT_PID;
 echo Agent pid 61467;

The agent is not stopped when the user logs out. The agent can be accessed again by setting the environment variables as above.

killall ssh-agent

Stop all ssh-agent processes you can (of not root this mean your own.

ssh-add <private key file>

Add the key to the agent, it asks for the passphrase if that is required

ssh-add -l

List the keys currently in the agent