Getting started with SSHSecure Shell (ssh) is available on all Common Unix Environment (CUE), cebafh, and CAD sytems at Jefferson Lab.
To begin using ssh you need to type "setup ssh" to set up paths to the ssh utilities.
The following sections hope to provide enough information to setup a user new to ssh with the appropriate files necessary for accessing remote hosts in a secure manner. Your login name is referred to as mylogin.
What this means is that it is safe to send your public key (i.e.
the contents of the
To further protect your private key you should enter a passphrase to encrypt the key when it is stored in the filesystem. This will prevent people from using it even if the gain access to your files.
ssh-keygen to create an authentication key for yourself. In most cases the defaults for this command are what you want.
Always, always, type in a good pass-phrase when prompted for one. It can be multiple words (i.e. spaces are just fine within the phrase), so you could choose a sentence that you can remember. Changing some of the words by misspelling them or by changing some of the letters into digits is highly recommended to increase the strength of your pass phrase.
Here is a sample session, your input is in bold. Note that the pass-phrase is not echoed back as you type it.
jlabs1> ssh-keygen Initializing random number generator... Generating p: .++ (distance 6) Generating q: ........++ (distance 110) Computing the keys... Testing the keys... Key generation complete. Enter file in which to save the key ($HOME/.ssh/identity): [RETURN] Enter passphrase (empty for no passphrase): litt1e 1amp jumb3d Enter same passphrase again: litt1e 1amp jumb3d Your identification has been saved in /home/mylogin/.ssh/identity. Your public key is: 1024 37 [lots of numbers] email@example.com Your public key has been saved in /home/mylogin/.ssh/identity.pubIf you have multiple accounts you might want to create a separate key on each of them. I have separate keys for
jlabs1> ssh-keygen -p Enter file in which the key is ($HOME/.ssh/identity): [RETURN] Enter old passphrase: litt1e 1amp jumb3d Key has comment 'firstname.lastname@example.org' Enter new passphrase (empty for no passphrase): br0wn cow 3ats grass Enter same passphrase again: br0wn cow 3ats grass Your identification has been saved with the new passphrase.The pass-phrases are not echoed as you type them.
Usually you will want to authorize access to the local system
using the local key (especially in an environment where multiple
systems share the same home directory e.g. using
jlabs1> cd ~/.ssh jlabs1> cp identity.pub authorized_keysYou could now copy the
Use a text editor to add
more keys to the file. If you use cut and paste to copy the key
make sure each key entry is a single line in the file.
The keys to add are always the public keys (from files
NOTE: To gain access to restricted systems you
might need to send your
public key in electronic mail to the administrator
of the system. Just include the contents of the
jlabs1> slogin hrothgar Enter passphrase for RSA key 'email@example.com': litt1e 1amp jumb3d Last login: Wed Oct 16 20:37:00 1996 from idefix [more output from the remote machine] hrothgar%You can avoid the pass-phrase prompts by keeping the authentication keys in memory. You only need to type the pass-phrase when you add a key into memory.
If your account name on the remote system differs from the one on
the local system (the system you are connecting from) you can use
jlabs1> slogin -l rem_login panix.com Last login: Sun Oct 13 14:55:17 1996 from jlabs1.cebaf.gov [more output from the remote machine] panix%You can change the default remote account name by creating a configuration file entry for the host.
When you start
jlabs1> ssh-agent $SHELL jlabs1>You will now need to add keys into memory to have them available for other commands.
jlabs1> ssh-agent startx &If your workstation has virtual consoles it is good to put the X window system in the background so the current virtual console can still be used for more commands if necessary. It won't hurt to background the command even without virtual consoles.
NOTE: Your system might have a non-standard way of starting the X window system. Replace startx with the appropriate command if necessary. Please ask your system administrator for the exact command to use.
#!/bin/sh if [ -d $HOME/.ssh ] then EXEC="exec ssh-agent" else EXEC="exec" fi if [ -x $HOME/.xinitrc ] then $EXEC $HOME/.xinitrc else $EXEC xterm -geometry 80x24+0-60 -ls fiMake sure the files are executable. The following command will change the permissions suitably.
jlabs1> chmod a+x ~/.xinitrc ~/.xsessionNOTE: If you are using an X-terminal keep in mind that your session is most likely not secure. Usually anything you type can be captured on the local area network you are connected to.
jlabs1> ssh-add Need passphrase for /home/mylogin/.ssh/identity (firstname.lastname@example.org). Enter passphrase: litt1e 1amp jumb3d Identity added: /home/mylogin/.ssh/identity (email@example.com)You can specify the file that contains the key if you have other identities than the default. You must use the private key file (the one that does not have the
jlabs1> ssh-add -d ~/.ssh/ispTo list all keys currently in memory use the
jlabs1> ssh-add -l 1024 37 [lots of numbers] firstname.lastname@example.org 1024 35 [lots of numbers] email@example.comYou can delete all keys from memory at once with the
jlabs1> ssh-add -DThis is useful if you have added keys into memory on remote systems and don't want to reconnect just to delete the keys.
jlabs1> ssh hrothgar who christos ttyp8 Oct 17 20:42 (milou) jlabs1>If you are using the X Window System you can use this capability to start a terminal window to start an interactive session on the remote system.
jlabs1> ssh -n hrothgar xterm &  15866 jlabs1>Use the
If you leave off the filename of the copy or specify a directory only the name of the source file will be used. An easy way of retrieving a copy of a remote file into the current directory while keeping the name of the source file is to use a single dot as the destination.
jlabs1> scp -p hrothgar:aliases . jlabs1>The
You can copy several files in a single command if the destination is a directory.
jlabs1> scp -p hrothgar:.login hrothgar:.logout panix.com:. jlabs1>Relative filenames resolve differently on the local system than on the remote system. On the local system the current directory is assumed (as usual with all commands). On the remote system the command runs in the home directory! Thus relative filenames will be relative to the home directory of the remote account.
NOTE: When you specify remote machines in both the source and the destination the connection to copy the files is made directly between those hosts. The files are not copied through the local system. Sometimes this makes a difference in a firewalled or otherwise restricted environment.
Host *panix.com User suominen Compression no Host *cebaf.gov FallBackToRsh no Host * Compression yes CompressionLevel 9 FallBackToRsh yes KeepAlive noOptions are accumulated over entries, but a more specific entry will override a less specific one. E.g. in the above compression will not be used for hosts that match