38,760
edits
SSH Keys/fr: Difference between revisions
Updating to match new version of source page
(Updating to match new version of source page) |
(Updating to match new version of source page) |
||
| Line 47: | Line 47: | ||
== Installing your key == | == Installing your key == | ||
=== Using CCDB === | |||
To install the key, you must make the target/destination system aware of the public part of your key. | To install the key, you must make the target/destination system aware of the public part of your key. | ||
On | On Compute Canada, we have recently (March 2021) added a convenient way to do this. You should visit: | ||
https://ccdb.computecanada.ca/ssh_authorized_keys | https://ccdb.computecanada.ca/ssh_authorized_keys | ||
| Line 62: | Line 65: | ||
OpenStack (cloud systems) do not read your key from CCDB as shown in the link above. | OpenStack (cloud systems) do not read your key from CCDB as shown in the link above. | ||
Sometimes, you may encounter a key that is in an alternate format | Sometimes, you may encounter a key that is in an alternate format. | ||
For instance, this is a public key in PEM format: | |||
-----BEGIN RSA PUBLIC KEY----- | -----BEGIN RSA PUBLIC KEY----- | ||
MIIBCgKCAQEAxFm+Fbs+szeV2Vg2T5ufg8az0jD9DD/A0iNLKef2/0gPULn1ebFQ | MIIBCgKCAQEAxFm+Fbs+szeV2Vg2T5ufg8az0jD9DD/A0iNLKef2/0gPULn1ebFQ | ||
| Line 73: | Line 76: | ||
-----END RSA PUBLIC KEY----- | -----END RSA PUBLIC KEY----- | ||
Public keys in RFC4716 or PKCS8 formats will look similar to PEM, with small variations in the header and footer lines. | |||
and | |||
=== Using the authorized_keys file === | |||
The CCDB method described above makes your public key available on all Compute Canada HPC systems. This is convenient, and is often desired. | |||
However, there may be circumstances in which you want to install a key only on a specific system. You can do this by adding the key | |||
to a file in your home directory on that system. For instance, to install a key that only works on Cedar, | |||
copy your public key into the file <code>~/.ssh/authorized_keys</code> on Cedar. | |||
This will allow you to log in to any of Cedar's login nodes using PK. | |||
On our systems (or any other with OpenSSH) the <code>ssh-copy-id</code> command is the most convenient way to do this: | |||
ssh-copy-id -i computecanada-key username@cedar.computecanada.ca | ssh-copy-id -i computecanada-key username@cedar.computecanada.ca | ||
The authorized_keys mechanism is standard, and almost universally used on the internet. It is however somewhat fragile: | The <code>authorized_keys</code> mechanism is standard, and almost universally used on the internet. It is however somewhat fragile: | ||
Specifically, SSH is quite picky about the permissions on the <code>authorized_keys</code> file, as well as your home directory and the <code>.ssh</code> subdirectory. | |||
This is described further in [[Using_SSH_keys_in_Linux|using SSH keys in Linux]]. | |||
== Advanced Key Usage == | == Advanced Key Usage == | ||
| Line 111: | Line 98: | ||
Although it's important to secure your private key by encrypting it with the passphrase, it is inconvenient to have to enter your | Although it's important to secure your private key by encrypting it with the passphrase, it is inconvenient to have to enter your | ||
passphrase every time you use the key. Rather than leaving the private key unencrypted, we strongly suggest using an SSH key agent. | passphrase every time you use the key. Rather than leaving the private key unencrypted, we strongly suggest using an SSH key agent. | ||
You type the passphrase when starting up the agent, after which the agent supplies the private key for new connections. | |||
This | This avoids storing the unencrypted private key on permanent storage, where it is more vulnerable to being stolen or copied. | ||
== Advanced Key Generation == | == Advanced Key Generation == | ||
ssh-keygen shown above is using defaults, which are OK, but may not be ideal. | ssh-keygen shown above is using defaults, which are OK, but may not be ideal. | ||