Difference between revisions of "SSH"
From Autopilot Wiki
(Created page with "== Enabling == * Use <code>sudo raspi-config</code> ** Interfaces ** SSH == Configuring == By default, configuration is stored in <code>/etc/ssh/sshd_config</code> === Use...") |
|||
(3 intermediate revisions by the same user not shown) | |||
Line 4: | Line 4: | ||
** Interfaces | ** Interfaces | ||
** SSH | ** SSH | ||
+ | |||
+ | === Headlessly === | ||
+ | |||
+ | Put an empty file named <code>ssh</code> in the root "boot" directory of a flashed raspi OS image. | ||
== Configuring == | == Configuring == | ||
Line 13: | Line 17: | ||
It's usually bad to be able to login with a password to a network facing computer, especially if your password is two letters like ours tend to be, so we typically want to disable password access over SSH and instead use RSA keys. | It's usually bad to be able to login with a password to a network facing computer, especially if your password is two letters like ours tend to be, so we typically want to disable password access over SSH and instead use RSA keys. | ||
− | * '''Enable password login via ssh''' | + | * '''On Target Machine - Enable password login via ssh''' |
** Edit /etc/ssh/sshd_config, make sure the following values are set | ** Edit /etc/ssh/sshd_config, make sure the following values are set | ||
*:<syntaxhighlight>ChallengeResponseAuthentication yes | *:<syntaxhighlight>ChallengeResponseAuthentication yes | ||
Line 20: | Line 24: | ||
** Restart the ssh service | ** Restart the ssh service | ||
*: <syntaxhighlight>sudo systemctl restart ssh</syntaxhighlight> | *: <syntaxhighlight>sudo systemctl restart ssh</syntaxhighlight> | ||
− | * '''Generate an RSA key''' | + | * '''On Source Machine - Generate an RSA key''' |
** check if you have an rsa key generated, they usually live in ~/.ssh | ** check if you have an rsa key generated, they usually live in ~/.ssh | ||
*: <syntaxhighlight>ls -al ~/.ssh</syntaxhighlight> | *: <syntaxhighlight>ls -al ~/.ssh</syntaxhighlight> | ||
Line 26: | Line 30: | ||
*: <syntaxhighlight>ssh-keygen -t rsa</syntaxhighlight> | *: <syntaxhighlight>ssh-keygen -t rsa</syntaxhighlight> | ||
*: you'll be prompted where to save the key (if you don't have one just leave it in the default location) and whether to use a passphrase. Having a passphrase means you need to type a password every time you want to use your rsa key. up 2 u. without a passphrase the security model is you assume that no one will be able to access your private key file | *: you'll be prompted where to save the key (if you don't have one just leave it in the default location) and whether to use a passphrase. Having a passphrase means you need to type a password every time you want to use your rsa key. up 2 u. without a passphrase the security model is you assume that no one will be able to access your private key file | ||
− | * '''Install the rsa key''' | + | * '''On Source Machine - Install the rsa key''' |
** Use ssh-copy-id | ** Use ssh-copy-id | ||
*: <syntaxhighlight>ssh-copy-id <user>@<ip or url></syntaxhighlight> | *: <syntaxhighlight>ssh-copy-id <user>@<ip or url></syntaxhighlight> | ||
** If you don't have ssh-copy id... | ** If you don't have ssh-copy id... | ||
*** On a Mac: | *** On a Mac: | ||
− | **: Install with homebrew. if you don't have homebrew the install command is | + | **: Install with [[Uses Unix Library::homebrew]]. if you don't have homebrew the install command is |
**: <syntaxhighlight>/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"</syntaxhighlight> | **: <syntaxhighlight>/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"</syntaxhighlight> | ||
**: then to install ssh-copy id it's | **: then to install ssh-copy id it's | ||
**: <syntaxhighlight>brew install ssh-copy-id</syntaxhighlight> | **: <syntaxhighlight>brew install ssh-copy-id</syntaxhighlight> | ||
− | * '''Disable password login via ssh''' | + | * '''On Target Machine - Disable password login via ssh''' |
** Edit /etc/ssh/sshd_config, make sure the following values are set | ** Edit /etc/ssh/sshd_config, make sure the following values are set | ||
*:<syntaxhighlight>ChallengeResponseAuthentication no | *:<syntaxhighlight>ChallengeResponseAuthentication no | ||
Line 43: | Line 47: | ||
*: <syntaxhighlight>sudo systemctl restart ssh</syntaxhighlight> | *: <syntaxhighlight>sudo systemctl restart ssh</syntaxhighlight> | ||
+ | == References == | ||
+ | |||
+ | * [[Cites URL::https://www.raspberrypi.com/documentation/computers/configuration.html]] | ||
Line 48: | Line 55: | ||
[[Category:Unixlike]] | [[Category:Unixlike]] | ||
[[Category:Configuration]] | [[Category:Configuration]] | ||
+ | [[Category:Software]] |
Latest revision as of 23:22, 28 December 2021
Enabling
- Use
sudo raspi-config
- Interfaces
- SSH
Headlessly
Put an empty file named ssh
in the root "boot" directory of a flashed raspi OS image.
Configuring
By default, configuration is stored in /etc/ssh/sshd_config
Use RSA Key
It's usually bad to be able to login with a password to a network facing computer, especially if your password is two letters like ours tend to be, so we typically want to disable password access over SSH and instead use RSA keys.
- On Target Machine - Enable password login via ssh
- Edit /etc/ssh/sshd_config, make sure the following values are set
ChallengeResponseAuthentication yes PasswordAuthentication yes UsePAM yes
- Restart the ssh service
sudo systemctl restart ssh
- On Source Machine - Generate an RSA key
- check if you have an rsa key generated, they usually live in ~/.ssh
ls -al ~/.ssh
- if you don't have an rsa key generated, generate a key:
ssh-keygen -t rsa
- you'll be prompted where to save the key (if you don't have one just leave it in the default location) and whether to use a passphrase. Having a passphrase means you need to type a password every time you want to use your rsa key. up 2 u. without a passphrase the security model is you assume that no one will be able to access your private key file
- On Source Machine - Install the rsa key
- Use ssh-copy-id
ssh-copy-id <user>@<ip or url>
- If you don't have ssh-copy id...
- On a Mac:
- Install with homebrew. if you don't have homebrew the install command is
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
- then to install ssh-copy id it's
brew install ssh-copy-id
- On Target Machine - Disable password login via ssh
- Edit /etc/ssh/sshd_config, make sure the following values are set
ChallengeResponseAuthentication no PasswordAuthentication no UsePAM yes
- Restart the ssh service
sudo systemctl restart ssh