Example of configuration access to a remote host machine using a public/private key pair instead of a password.
If you use a CI/CD in your project to deploy server environment - you some time needs access to remote host over ssh.
Basically you can access to remote host with a password, but it is uncomfortable to use in CI/CD tools.
SSH allows you to use pair of private and public key for authentication. Briefly, you will use private key on the build machine and public key on the host machine, and when you will establish a connection to the host machine - ssh will be uses the public/private key pair to authenticate you.
Steps:
- Generating public / private key pair.
- Uploading public key to a host machine.
- Using private key at the build machine.
Generating public / private key pair
ssh-keygen -t TYPE
Type should be one of dsa | ecdsa | ed25519 | rsa, lets use ecdsa for an example.
Enter only path to save generated key pair and do not enter a password (just press enter).
Your shell output will be look like this:
Generating public/private ecdsa key pair.
Enter file in which to save the key (/Users/max/.ssh/id_ecdsa): ./id_ecdsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ./id_ecdsa.
Your public key has been saved in ./id_ecdsa.pub.
The key fingerprint is:
SHA256:A9XBfGwhcTk0Q/ok4w8rYH+gjft+k5szhZmAEmmKu9E
The key's randomart image is:
+---[ECDSA 256]---+
| . .++*Bo |
| + . ++*o |
| . o ... +o.. |
|. . . .... = |
| o .o S.o+. |
|o E . * o++. |
| o o + oo. |
|. . o*. |
| .oo.o= |
+----[SHA256]-----+
I set the file path equals to . / Id_ecdsa, then in the folder where the command ssh-keygen was executed there will
be two files:
-rw------- 1 max staff 513B Jun 28 14:01 id_ecdsa
-rw-r--r-- 1 max staff 182B Jun 28 14:01 id_ecdsa.pub
Uploading public key to a host machine.
Now, lets upload our public key to the remote host.
ssh-copy-id -i ./id_ecdsa.pub root@HOST_ADDRESS
This command uploads ./id_ecdsa.pub to the remote host with address HOST_ADDRESS and configure it to use the public key
for users authentication.
The command ask you a password for remote host machine.
Your shell output will be look like this:
ssh-copy-id -i ./id_ecdsa.pub root@HOST_ADDRESS
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "./id_ecdsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@185.159.129.226's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'root@HOST_ADDRESS'"
and check to make sure that only the key(s) you wanted were added.
Using private key at the build machine.
Now we can load the private key on the build machine, and connect to the remote machine without a password:
Load the private key:
cat id_ecdsa | tr -d '\r' | ssh-add - > /dev/null
Access to the remote host:
ssh 'root@HOST_ADDRESS'
Your shell output will be look like this:
Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-145-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
Simple example of a job to deploy a project:
# load private key
cat id_ecdsa | tr -d '\r' | ssh-add - > /dev/null
# copy useful project file to the remote host
scp server.sh root@HOST_ADDRESS:~/
# execute the project file on the remote host
ssh root@HOST_ADDRESS "~/server.sh"
Result:
After prepare private/public keys and upload public key to a host machine, you can use private key to get access without a password.