3 - CYGWIN ssh

Using ssh in CYGWIN to Connect to a Host WITHOUT Using a Password or Passphrase

Remember the the rules about "readme" files.

Assumptions:

1. You have Cygwin installed
2. You have the open-ssh and open-ssl packages installed
3. You have my OLB (/olb) "package" (i.e. tar file) installed
4. You know how to use or are using the "xt" and/or "ssx" and/or "sshlh" and/or "sshrh" provided via OLB routines and/or ssh to connect to a user/host

Of course using OLB, ssx / xt / sshlh ... is not required, but these are the routines that are used here to support ssh-xterm connections, so all instructions revolve around them being present and used.

With the above being true, then, if you have been using the "OLB" routines or ssh then you have been using ssh to connect, but you have been using a password.

These instructions will guide you through setting up public/private ssh key pairs to use for authentication in place of passwords.

Procedure:

• A - Create the ssh key-pairs:
  • 1 - Start Cygwin and go to / stay in your home directory
    • display your Cygwin username and host name.

If you are using the OLB prompt, then you can see your username and host name as part of the prompt.

• 2 - Enter the command: genkey or keygen (they are the same)
  • a - at the prompt, press the "Enter" key
    • you will get the message:

• b - and the prompt:
  • Enter file in which to save the key (/home/<username>/.ssh/id_rsa):
• c - press "Enter" at this prompt (leave the file name empty and use the default name)
• d - you will get the message:

• e - you MAY get the following, but if you haven't done this before, you should not:

• enter "y" for this prompt, create a new key overwriting the old key
  • Of course, if you already have a key-pair, then one has to ask one's self,
    • "why am I generating a new key-pair?"
    • and perhaps (or perhaps not) the better answer is "n".
    • Then perhaps you should start again and at step 2.b, enter a new file name,
    • perhaps like: id_rsa_new and then continue the procedure
• f - you will get messages like:

• g - and the prompt:

• press the "enter" key
  • h - you will get messages like:

• i - and the prompt:

• enter "y" for this prompt
• j - you will get messages like:

• Do NOT forget to check/change (chmod) the permissions for your home directory and .ssh directory and the private key file(s)

• B - Configure PuTTY to support X-Windows (xterm sessions)
  • Install your public key on the remote host
    • 1 - Connect to the remote host and ensure that the directory ~/.ssh exists

This means YOUR home directory must have a sub-directory named .ssh

Also ensure that the permissions for your home directory are no more open than 755

Also ensure that the permissions for your .ssh directory are no more open than 755

• 2 - In CYGWIN, on your windows PC, enter the command:

• enter the following command to send your public key to the remote host:

• Now you know why you need to know your username and hostname. More on this later.
• Accept the RSA Fingerprint for the remote host - if prompted.
• Enter your password when prompted.
• 3 - Connect or switch to the remote host and
  • cd to .ssh in your home directory
  • enter the command:

This puts your public key in the key file on the remote host.

• 4 - Test your connection:
  • from a Cygwin window enter:

• You MAY get a "one-time" message and prompt like:

• Enter "yes" for the prompt
• This will update the ~/.ssh/known_hosts file
• you should be logged on to the remote host.
• 5 - Repeat steps B.1 - B.4 for each remote host that you want to connect to.
• 6 - I interconnect a minimum of 17 different host systems.
  • All the connections are maintained via ssh using rsa public/private keys.
  • I keep one master authorized_keys where I store and distribute my public keys.
  • create rsa and/ecdsa key-pairs on each host.
  • scp each id_rsa.pub file to a common host (my cygwin windows pc) and rename the file during the scp operation.
    • This is the reason for renaming the file during the scp.
    • It helps track the origin of the key and prevents overwriting the keys as I gather them together.
  • cat (append) each id_rsa.??.??.pub file to authorized_keys
  • scp the master authorized_keys file to each host ( ~/.ssh on each host)

• WARNING:
  • If someone gains access to your session (especially your CYGWIN session),
  • they may be able to access all of your hosts, posing as you.

• KEEP YOUR PC LOCKED WHEN YOU WALK AWAY.
• KEEP YOUR PASSWORD SECRET
• USE A STRONG PASSWORD.

• C - Maintenance Notes:
  • 1 - There are times when you suddenly will not be able to log onto a remote host.
    • This can be caused if the host fingerprint key of the host does not match the fingerprint key saved in your ~/.ssh/known_hosts file.

This is a common situation if the remote host has be be moved to a new machine or certain other changes have been made to the remote host.

• cd ~/.ssh
• edit file: known_hosts
  • delete the line for the host having the problem.
• reconnect
  • You will be prompted to accept the RSA key fingerprint of the remote host.
  • If this was the problem, then all is now well.

• 2 - Do you like PuTTY as an interface to AIX/UNIX/LINUX?
  • If you do, then you have to try WINSCP.
  • It's like WINFTP but it uses SCP or SFTP
  • You can use Public/Private keys created with the PuTTY keygen routine to do password-less connections.