SSH Keys for CSRES (Mac and Linux)

Table of contents

1. Introduction
2. Creating a key
3. Copying your key to a server
   1. ​From UT VPN, UT wireless, or CS network
      1. Using ssh-copy-id
      2. Using the manual method
   2. From off campus​
4. Using ssh-agent (optional)
5. Disable password logins
6. Additional information

For instructions on adding SSH keys for other platforms, visit this FAQ.

Introduction

As of April 12, 2019, SSH keys are required when SSHing to CS/CSRES networks when outside of our networks, campus wireless, or the VPN. The University ISO will quarantine any host allowing SSH access that has not disabled password authentication.

An SSH key pair consists of two keys: One public key and one private key. The public key, as the name suggests, is public and can be safely shared with the world. The private key should never be shared with anyone and should be kept safe.

In order to use SSH keys to connect to a remote computer, one must first create an SSH key pair on one's computer, then copy the public SSH key to the remote computer. You will create an SSH key pair on each computer that you want to SSH from. You can use the same public SSH key from one computer to connect to many others.

E.g., if you have two computers at home, home1 and home2, and want to use them to connect to remote1, remote2, and remote3 you would create an SSH key pair on both home1 and home2, and then send the public key from home1 to all three remote computers, and lastly you would send the public key from home2 to all three remote computers.

Below are the necessary instructions to create an SSH key pair and add your public key to your CSRES machine. For the purposes of these instructions, we will assume that you want to SSH into a CSRES machine from a computer at home. To avoid confusion, we will use the following terminology:

HOME = Your home computer
CSRES_USER = Your CSRES machine's username
SERVER.csres.utexas.edu = The machine that you need to SSH into and add an SSH key to.

NOTE: All commands will be run on HOME, unless otherwise specified.

Creating a key

To create a 4096-bit RSA key, run the following:

1. ssh-keygen -t rsa -b 4096
2. Press Enter to use the default location. (Recommended) ¹
3. Enter a passphrase (ALWAYS use a passphrase!!) ^{2 3}
4. Enter your passphrase a second time.

It should look something like this:

Your public SSH key is located by default at ~/.ssh/id_rsa.pub and is perfectly safe to be shared with anyone.

Your private SSH key will be located by default at ~/.ssh/id_rsa. You should NOT touch this file or share it with anyone.

Copying your key to a server

From UT VPN, UT wireless, or CS network

If you are connected to UT VPN, or have brought your machine on campus and have connected to UT wireless or the CS network, then you can use one of the methods below. If for any reason the ssh-copy-id method does not work, you can still copy your public SSH key manually using the second method.

You can find more information on how to connect to UT VPN by visiting this page.

Using ssh-copy-id

To copy your SSH public key from HOME to SERVER.csres.utexas.edu, simply replace the ssh in a normal SSH command with ssh-copy-id, as shown below:

1. ssh-copy-id CSRES_USER@SERVER.csres.utexas.edu
2. If you see the text "Are you sure you want to continue connecting (yes/no)?" type yes and press Enter.
3. Enter CSRES_USER's password to send your public key to the server.

It should look something like this:

Congratulations! You can now use your SSH key to log into your CSRES machine!

Using the manual method

If for any reason the ssh-copy-id method does not work, you can still copy your public SSH key manually.

1. cat ~/.ssh/id_rsa.pub | ssh CSRES_USER@SERVER.csres.utexas.edu "umask 0077 && mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
2. If you see the text "Are you sure you want to continue connecting (yes/no)?" type yes and press Enter.
3. Enter CSRES_USER's password to send your public key to the server.

From Off Campus

Copy to a USB drive

If you are unable to connect to UT VPN or cannot bring your machine to campus, then copying your public SSH key to a USB drive is another solution.

On your home computer:

1. Plug in a USB drive.
2. If it does not auto-mount, open a file manager and open the USB device to view its contents.
3. In a terminal, run df -hT to find the full path to your mounted USB drive. (Your USB's mountpoint path will likely start with /media/yourusername)
4. cp ~/.ssh/id_rsa.pub /media/yourusername/directory/ (Replace the second path with your real USB drive's mount point path)
5. Safely unmount/eject your USB drive and bring it to campus.

From here, you will want to log into a CS lab machine and do:

1. Plug in the USB drive
2. If it does not auto-mount, open a file manager and open the USB device to view its contents.
3. In a terminal, run df -hT to find the full path to your mounted USB drive.
4. cat /media/yourusername/directory/id_rsa.pub >> ~/.ssh/authorized_keys (Replace the second path with your real USB drive's mount point path)
5. chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
6. If step #5's command gives any errors, please submit a helpreq.
7. Safely unmount/eject your USB drive.

Using ssh-agent (optional)

ssh-agent is a program included in OpenSSH that will remember your SSH key and not require you to type its passphrase each time you use SSH. Your desktop environment on HOME should start up ssh-agent when you log in.

1. To add your SSH key to the agent, simply type:
   ssh-add

2. Type in your SSH key's passphrase and you're good to go!

You won't need to type in your passphrase any longer. Once you log out ssh-agent will be killed and you will need to repeat the above process the next time you log in.

Disable password logins

In order to disable password logins, you will need to edit the /etc/ssh/sshd_config file on the CSRES machine itself and reload the SSH daemon. Note that you will need sudo or root permissions to do this.

1. Using your preferred editor, edit your /etc/ssh/sshd_config and add the following options at the end, but BEFORE any lines that start with "Match".

   PasswordAuthentication no
ChallengeResponseAuthentication no
UseDNS yes
Match Host *.cs.utexas.edu,*.csres.utexas.edu,wireless*public.utexas.edu,*.vpn.utexas.edu
  PasswordAuthentication yes

2. Once the options have been modified, you will need to reload the SSH daemon on your linux machine (you do not need to reload anything on a Mac):

   1. For Ubuntu-based distributions:
      systemctl reload ssh

   2. For Red Hat-based distributions:
      systemctl reload sshd

Additional information

1. More in-depth information on SSH keys
2. Wikipedia: ssh-agent
3. Selecting a strong password