Linux Networking Cookbook

7.5. Using Public-Key Authentication to Protect System Passwords

Problem

You are a bit nervous about using system account logins over untrusted networks, even though they are encrypted with SSH. Or, you have a number of remote servers to manage, and you would like to use the same login on all of them, but not with system accounts. In fact, you would like your remote logins to be decoupled from system logins, plus you would like to have fewer logins and passwords to keep track of.

Solution

Give yourself a single login for multiple hosts by using public-key authentication, which is completely separate from local system accounts. Follow these steps:

Install OpenSSH on all participating machines, and set up host keys on all participating machines. (Host keys always come first.)

Then, generate a new identity key pair as an ordinary unprivileged user, and store it in your ~/.ssh directory on your local workstation. Be sure to create a passphrase:

	$ ssh-keygen -t rsa
	Generating public/private rsa key pair.
	Enter file in which to save the key (/home/carla/.ssh/id_rsa):
	Enter passphrase (empty for no passphrase):
	Enter same passphrase again:
	Your identification has been saved in /home/carla/.ssh/id_rsa.
	Your public key has been saved in /home/carla/.ssh/id_rsa.pub.
	The key fingerprint is:
	38:ec:04:7d:e9:8f:11:6c:4e:1c:d7:8a:91:84:ac:91 carla@windbag

Protect your private identity key from accidental overwrites:

	$ chmod 400 id_rsa

Now, copy your new public key (id_rsa.pub) to all of the remote user ...