Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Intermediate and Advanced SSH

|

135

There’s one last thing I should mention about Example 4-4. It makes two assump-

tions about the remote server:

• That I have the same username as I do locally.

• That the remote server recognizes SSH Protocol v2.

If the first assumption isn’t true, I need either to use the

-l flag to specify my user-

name on the remote host or, instead, to use scp-style username@hostname syntax—

e.g.,

[e-mail].

If Protocol v2 isn’t supported by the remote sshd daemon, I’ll have to try again with-

out the

-2 flag and let SSH fall back to username/password authentication, unless

I’ve got an RSA key pair whose public key is registered on the remote machine.

To do all this with RSA keys, we follow pretty much the same steps but with differ-

ent filenames:

1. Create an RSA user-key pair with ssh-keygen, for example:

ssh-keygen -b 1024 -C [e-mail]

2. On each remote host to which you wish to connect, copy your public key onto

its own line in the file authorized_keys in your $HOME/.ssh directory. (The

default filenames for RSA keys are identity and identity.pub.)

Again, if you run ssh without the

-2 flag, it will try RSA authentication by default.

What happens if you forget your RSA or DSA key’s passphrase? How will you get

back into the remote machine ...