SSH HostkeyAlgorithms and private keys

A note for .ssh/config and .ssh/authorized_keys

The file should contain

HostkeyAlgorithms =+ssh-dss,ssh-rsa

Note the =+

I had received the following error earlier;

Unable to negotiate with xx.xx.xx.xx port 22: no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519

and couldn't for the life of me understand why. Eventually tracing down the config file from above was missing the =+ and I'm assuming this meant is was only allowing ssh-dss,ssh-rsa and causing the error above.

Private Keys

In other news, if we wish to login to a box using a private key, we would normally do something like:

ssh -i path_to_key user@ip_address

We can also create a .ssh/config (600) file or amend it to include the details so that we can login with something like:

ssh host

As an example, we would add the below:

Host oracle
    HostName 192.168.254.121
    User opc
    IdentityFile ~/.ssh/oracle.key

where oracle would be the host name and the private key would be in .ssh/oracle.key

We can then do ssh oracle

To login using a private key

1) Generate a public key on the client machine, for example;

ssh-keygen -t ed25519 -C "SolarOS"

This will create id_ed25519 and id_ed25519.pub (where the *.pub is the public key).

Note: we can use the -f flag to provide the name for the key pair, for example;

ssh-keygen -t ed25519 -f ./solar_os_deploy_key -C "SolarOS"

2) Copy the public key to the server, for example;

scp ed25519.pub a_user@192.168.254.198:/home/a_user/

3) copy the file into .ssh/authorized_keys, for example;

cat ed25519.pub >> .ssh/authorized_keys (make sure the permissions of authorised_keys is 700)

4) Remove the ed25519.pub key form the server.

Then to log in from the client, simply do ssh host@server

The above can also be done on the server;

Step 1 creating the private and public key pair. 

Step 2 would then mean copying the private key and not the public key to the client, with the client saving it in .ssh/

Step 3 would be done on the server, with its own public key.

Step 4 is the same, removing the public key from the server.

We would then login from the client with ssh i .ssh/name_of_private key user@host

The .ssh/authorized_keys contains the public keys and .ssh/ contains private keys which you reference with ssh -i