SSH Organization Tips

Over the years, I have worked with many SSH boxen and had the pleasure to manage even more SSH keys. The problem with all that is the keys start to build up and then you wonder which boxes have which keys in the authorized keys file and so on and so on. Well, I can’t say I have the ultimate solution, but I do have a few tips that I have come across along the way. Hopefully they will be of use to someone else besides myself.

1. Although this should hopefully already be done (my fingers are crossed for you), check the permissions on your ~/.ssh directory and the file contained in it.

   1 2 3

   $ chmod 700 ~/.ssh $ chmod 600 ~/.ssh/id_dsa $ chmod 640 ~/.ssh/id_dsa.pub

2. Now that SSHv2 is pretty widely accepted, try using that for all your servers. If that isn’t possible, then try to use SSHv2 whenever possible. This means a few things.
   1. Change your /etc/ssh/sshd_config file to say:

      1	Protocol 2

      instead of

      1	Protocol 1

   2. Don’t generate anymore RSA keys for yourself. Stick to the DSA keys:

      1 2	$ cd ~/.ssh $ ssh-keygen -t dsa

   3. Use public key based authentication and not password authentication. To do this change your /etc/ssh/sshd_config file to read:

      1	PubkeyAuthentication yes

      instead of

      1	PubkeyAuthentication no

3. Keeping track of which keys are on the machine is a fairly simple yet often incomplete task. To allow for a user to login using their SSH(v2) key, we just add their public key to the ~/.ssh/authorized_keys file on the remote machine:
   1. Copy the file to the remote machine:

      1	$ scp id_dsa.pub user@host:.ssh/

   2. Append the key onto the authorized_keys file:

      1	$ cat ~/.ssh/id_dsa.pub >> ~/.ssh/authorized_keys

   Before moving on here and just deleting the public key, let’s try some organizational techniques.

   1. Create a directory in ~/.ssh to store the public keys in:

      1	$ mkdir ~/.ssh/pub

   2. Move the public key file into that directory and change the name to something useful:

      1	$ mv ~/.ssh/id_dsa.pub ~/.ssh/pub/root@main.mydomain.com

   NOTE: Don’t do this unless you are sure that you can log in with your public key otherwise you WILL lock yourself out of your own machine.

4. Now a little of the reverse side of this. If a public key is no longer is use, then you should remove it from your ~/.ssh/authorized_keys file. If you have been keeping a file list in the directory, then the file should be removed from the directory tree as well. A little housekeeping is not only good for security, but also some piece of mind in efficiency and general cleanliness.
5. Although this last item isn’t really organizational, it is just really handy and I will categorize it under the title of efficiency. Using ssh-agent to ssh around. If you are a sysadmin and you want to only type your passphrase once when you login to your computer, then do the following:
   1. Check to see if the agent is running:

      1	$ ssh-add -L

      NOTE: If ssh-agent is not running, it will say The agent has no identities.

   2. If its running, continue to the next step, otherwise type:

      1	$ ssh-agent

   3. Now to add your key to the agent’s keyring, type:

      1

      $ ssh-add

   SSH to a machine that you know has that key and you will notice that you will no longer have to type in your passphrase while your current session is active.

These are just some tricks that I use to keep things sane. They may not work for you, but some of them are good habits to get into. Good luck.