2.24.2013

Mac OS X key-based ssh login

To set up key-based SSH, you must generate the keys the two computers will use to establish and validate the identity of each other. To do this run, the following commands in Terminal: Check to see whether a .ssh folder exists in your home directory by running the command ls -ld ~/.ssh. If .ssh is listed in the output, move to step 2. If .ssh is not listed in the output, run mkdir ~/.ssh and continue to step 2. Run: cd ~/.ssh Run: ssh-keygen -b 1024 -t dsa -f id_dsa -P '' This command generates the public and private keys. The -b flag sets the length of the keys to 1,024-bits, -t indicates to use the DSA hashing algorithm, -f sets the file name as id_dsa, and -P '' sets the private key password to be null. The null private key password allows for automated SSH connections. Run: touch authorized_keys2 Run: cat id_dsa.pub >> authorized_keys2 Run: chmod 400 id_dsa The permissions on the private key must be set so that the file is not world readable. Run: scp authorized_keys2 user@host :~/.ssh/ This command copies the public key and the authorized key lists to the specified user's home directory on the remote computer. If you need to establish two-way communication between servers, repeat the above process on the second computer. It is not secure to copy the private key of one computer to another computer. This process must be repeated for each user that needs to be able to open a key-based SSH session. The root user is not excluded from this requirement. The home folder for the root user on OS X is typically located at /var/root/.