A SSH key with a passphrase provides additional security and can act as an additional authentication factor. Adding a passphrase to your SSH keys is recommended to comply with the Remote Access Services Requirement of the Minimum Security Standard for Networked Devices (MSSND)
See instructions for setting up SSH key authentication for Windows, Mac, and Linux below.
Windows
Generate and upload SSH Key
-
Install PuTTY from https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
-
Open PuTTYgen.
-
Select RSA from Type of key to generate.
-
Generate.
-
Add a key comment that identifies what local computer the public key belongs to.
-
Add key passphrase and confirm passphrase. Passphrases must meet campus passphrase requirements.
-
Save the private key to your computer. Use a descriptive name that identifies what server the private key belongs to.
-
You may save the public key as well, but you can always retrieve the public key by loading the private key file from the last step. Saving the public key will save it in a text format that will not correspond directly to the text needed for pasting into the authorized_keys file.
-
Highlight the entire public key from the PuTTYgen window and copy the text.
-
SSH into the server with your existing credentials.
-
Use your preferred text editor to create and/or open the authorized_keys file at ~/.ssh/authorized_keys
-
Paste the public key into the authorized_keys file.
-
Save the file and close the text editor.
-
Save the private key passphrase to LastPass.
Add a password to existing SSH key
- Open PuTTYgen.
- Click Load an existing private key file.
- Navigate to the private SSH key file on your computer. The private key will generally have a .ppk (PuTTY Private Key Files) extension. If your private key has a different extension, change the Files of Type to All Files (*.*)
-
The public key for pasting into the OpenSSH authorized_keys file will populate above.
-
Add or change the passphrase for the public/private key pair.
-
You will have to overwrite the original private key when saving.
Open a SSH session with the SSH key
-
Open PuTTY.
-
Enter the remote server Host Name or IP address under Session.
-
Go to Connection > SSH > Auth.
-
Under Authentication parameters > Private key file for authentication click Browse.
-
Locate your private key.
-
To save these settings, return to Session and add a name for this connection to Saved Sessions then hit Save.
-
Open.
Official PuTTY Documentation
Official PuTTY Documentation can be found on the PuTTY website.
Mac
Generate and upload SSH Key
-
Go to Applications > Utilities > Terminal
-
Type in the command ssh-keygen
Running ssh-keygen will produce the following messages and prompts:
ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/[username]/.ssh/id_rsa): /home/[username]/.ssh/[key name] If creating more than one key, use a descriptive name that identifies what server the key belongs to, and note the name for later. If not, use the default.
Enter passphrase (empty for no passphrase): Passphrases must meet campus passphrase requirements.
Enter same passphrase again:
Your identification has been saved in [key name].
Your public key has been saved in [key name].pub.
The key fingerprint is:
SHA256:GKW7yzA1J1qkr1Cr9MhUwAbHbF2NrIPEgZXeOUOz3Us [username]@[yourcomputer].local
The key's randomart image is:
+---[RSA 2048]----+
|.*++ o.o. |
|.+B + oo. |
| +++ *+. |
| .o.Oo.+E |
| ++B.S. |
| o * =. |
| + = o |
| + = = . |
| + o o |
+----[SHA256]-----+
#
-
You can copy the key to the clipboard by running pbcopy < ~/.ssh/[key name].pub or pbcopy < ~/.ssh/id_rsa.pub if the default was used.
-
SSH into the server with your existing credentials.
-
Use your preferred text editor to create and/or open the authorized_keys file at ~/.ssh/authorized_keys
-
Paste the public key into the authorized_keys file.
-
Save the file and close the text editor.
-
Save the private key passphrase to LastPass.
Open a SSH session with the SSH key
If only one key has been made connect with ssh [username]@[server]
If multiple keys have been made connect with ssh -i ~/.ssh/[key name] [username]@[server]
Linux
Generate and upload SSH Key
-
Go to Activities > Terminal
-
Type in the command ssh-keygen
Running ssh-keygen will produce the following messages and prompts:
ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/[username]/.ssh/id_rsa): /home/[username]/.ssh/[key name] If creating more than one key, use a descriptive name that identifies what server the key belongs to, and note the name for later. If not, use the default.
Enter passphrase (empty for no passphrase): Passphrases must meet campus passphrase requirements.
Enter same passphrase again:
Your identification has been saved in [key name].
Your public key has been saved in [key name].pub.
The key fingerprint is:
SHA256:GKW7yzA1J1qkr1Cr9MhUwAbHbF2NrIPEgZXeOUOz3Us [username]@[yourcomputer]
The key's randomart image is:
+---[RSA 2048]----+
|.*++ o.o. |
|.+B + oo. |
| +++ *+. |
| .o.Oo.+E |
| ++B.S. |
| o * =. |
| + = o |
| + = = . |
| + o o |
+----[SHA256]-----+
#
-
Copy the public key to the server using either of the following:
-
Run the command ssh-copy-id -i ~/.ssh/[key name].pub [username]@[server] or ssh-copy-id -i ~/.ssh/id_rsa.pub [username]@[server] if the default was used.
-
Manually copy the key to the authorized_keys file.
-
Highlight the entire public key from the terminal window and copy the text.
-
SSH into the server with your existing credentials.
-
Use your preferred text editor to create and/or open the authorized_keys file at ~/.ssh/authorized_keys
-
Paste the public key into the authorized_keys file.
-
Save the file and close the text editor.
-
Save the private key passphrase to LastPass.
Open a SSH session with the SSH key
If only one key has been made connect with ssh [username]@[server]
If multiple keys have been made connect with ssh -i ~/.ssh/[key name] [username]@[server]Current as of 5/12/2021