Related

This will create and store both your public and private keys in your /.ssh directory. It will overwrite any existing keys as well. To generate these keys, simply type ssh-keygen -t rsa -b 2048 and follow the prompts. To install the keys to the default location, just. How can I find the private key for my SSL certificate. If you just got an issued SSL certificate and are having a hard time finding the corresponding private key, this article can help you to find that one and only key for your certificate.

Status: Deprecated

This article covers a version of Ubuntu that is no longer supported. If you are currently operate a server running Ubuntu 12.04, we highly recommend upgrading or migrating to a supported version of Ubuntu:

• Upgrade to Ubuntu 14.04.

Reason:Ubuntu 12.04 reached end of life (EOL) on April 28, 2017 and no longer receives security patches or updates. This guide is no longer maintained.

See Instead:
This guide might still be useful as a reference, but may not work on other Ubuntu releases. If available, we strongly recommend using a guide written for the version of Ubuntu you are using. You can use the search functionality at the top of the page to find a more recent version.

Introduction

When configuring a large amount of servers that have many users, keeping SSH access in line for your infrastructure can get complicated. There are quite a few ways of implementing a centralized authentication authority, such as LDAP, but these are sometimes overkill.

SSH actually has the functionality to use a certificate authority to authenticate servers and clients. This works both ways. Using this system, you can authenticate a host to a client, avoiding confusing messages about being unable to validate the authenticity of the host. You can also validate the client to the host, allowing you to register a new SSH key in one place and allow access across your organization.

We’ll discuss how to leverage these certificates in both of the ways discussed above. We’ll be demoing this on three Ubuntu 12.04 VPS instances. One will serve as the host, another as the client, and the third will function as the certificate authority.

How To Configure Host Certificates

We will start by configuring certificates that will authenticate our servers to our clients. This will allow our clients to connect to our servers without needing to question the authenticity of the server.

We begin on the machine that we will be using as the certificate authority. In this example, we’ll refer to this as “auth.example.com”.

Generating Signing Keys

First, we need to generate some RSA keys that will function as the signing keys. Use any user you’d like, but the root user is probably a good idea. We will be creating keys called “server_ca” and “server_ca.pub” since these will be used to authenticate our servers.

Let’s create these keys in our home directory:

You will be asked if you’d like to create a passphrase. This will add an additional layer of protection to your key in the event that it falls into the wrong hands. Once this is finished, you’ll have a private and public key in your home directory:

Signing Host Keys

Now that we have our keys, we can begin signing our host keys.

We should start by signing the host key of the certificate authority itself. We can do this using the following syntax:

Let’s go over what all of this means.

• -s: This is the private key that we just created that we will use to sign all of the other keys.
• -I: This is a name that is used to identify the certificate. It is used for logging purposes when the certificate is used for authentication.
• -h: This marks the resulting certificate as a host key, as opposed to a client key.
• -n: This is used to identify the name (user or host) that is associated with this certificate.
• -V: This specifies how long the certificate is valid for. In this instance, we specify that the certificate will expire in one year (52 weeks).

Afterwards we specify the key that we want to sign.

In our case, to sign our own host RSA key, we will use a line that looks like this. We are going to identify this server as “host_auth_server”. We will be prompted for the passphrase we used when creating the signing key:

As you can see from the output, our certificate is valid for one year. It has been created in the same directory as our server host key (/etc/ssh/) and is called “ssh_host_rsa_key-cert.pub”. Redhat generate ssh host keys.

Now that we have signed our host key on the certificate authority itself, we can sign the host key for the separate SSH server we’re trying to authenticate to clients.

Copy the host key from our SSH server. We’ll refer to this machine as “sshserver.example.com”. You can do this using scp:

Now, we can create a certificate from this file using the same method we used above. We’ll need to change some values to refer to the new host we’re signing:

Now, we need to copy the generated certificate file back onto the host. Again, we can use scp for this:

Afterwards, we can delete both the SSH server’s public key and certificate from our authentication server:

We now have the signed certificates in place, we just need to configure our components to use them.

Configuring Components to Use Host Certs

First, we need to continue with both of our servers (auth.example.com and sshserver.example.com) to make them aware of the certificate files we created.

On both of these machines, we’ll have to edit the main SSH daemon configuration file. Make sure you are editing the sshd_config file, not the ssh_config file:

If you can find a HostCertificate line, modify it. Otherwise, add this to the bottom of the file. We need to establish to path to our host certificate file:

Save and close the file when you are finished.

Now, restart the SSH daemon to make these changes happen:

Do this on all of the servers you are configuring host certificates for.

Now, our servers are configured to use the certificate, but our client does not know how to check the certificate that the server will present.

On our client machine, which we’ll be referring to as “client.example.com”, open or create the “~/.ssh/known_hosts” file:

We need to remove any entries that have to do with the servers we’re configuring for certificate entry. It may be best to delete everything.

Afterwards, we need to add a special entry that specifies the public key that we should use to check the certificate that our hosts will give us during login. Start it off with @cert-authority. Afterwards, it can include a domain restriction where the key will be applied, followed by the public certificate authority key that we’ve been signing everything with.

On your certificate authority machine, you can get the public certificate signing key by typing:

Using this information, the line in your ~/.ssh/known_hosts file should look like:

Save and close the file when you’re done.

Now, when you visit the SSH server for the first time from your client (using the full hostname), you should not be asked whether you trust the remote host. This is because the host has presented its host certificate to you, signed by the certificate authority. You’ve checked your known_hosts file and verified that the certificate is legitimate.

How To Configure User Keys

Now that we’ve learned how to authenticate servers to our users, we can also configure our certificate authority to authenticate our users to our servers.

As before, this process will start on our certificate authority server. We will need to generate a new set of keys, this time, to sign user certificates:

Again, select a passphrase so that your key will be protected if someone gains access.

Generate Ssh Rsa Key From Certificate Pdf

Configuring Servers to Accept Logins with the User Certification

When you are done, you will need to copy the public key onto each of your SSH servers that need to validate user authenticity. We will do this using scp as usual:

We need to modify our SSH daemon configuration on our SSH server to look for this key.

On our “sshserver.example.com” host, open the configuration file:

At the bottom, below our HostCertificate line, we need to add another line that references the file we just copied over:

Extract Ssh Public Key From Private Key

Again, we’ll need to restart the SSH daemon for these changes to take place:

Signing User Login Keys

Now that the servers are configured to trust keys signed by the users_ca key, we need to actually sign the users’ authentication keys so that this scheme will work.

First, we need to get our client key onto the certificate authority server with scp. From the cert server, type:

Now that we have the key on the cert machine, we can sign it using our users_ca key. This will be very similar to last time we signed keys using the server_ca keys, only now, we don’t include the -h parameter, because these are user keys.

The command we want is something like this. Change the “username” value to reflect the name of the user you’re signing for easier management:

You will be prompted for the users_ca passphrase that set during the key’s creation. Now, we have an id_rsa-cert.pub file in our directory that we need to transfer back onto our client machine:

Now, when you log into sshserver.example.com from your client computer, you should not be asked for your authentication details, even if you’ve never before logged into this server as this user.

Create Rsa Key Linux

Conclusion

By signing your host and user keys, you can create a more flexible system for user and server validation. This allows you to set up one centralized authority for your entire infrastructure, in order to validate your servers to your user, and your users to your servers.

Generate Ssh Rsa Key From Certificate Online

While perhaps not the most powerful way of creating centralized authentication, it is easy to set up and leverages existing tools without requiring a lot of time and configuration. It also has the advantage of not requiring the CA server to be online to check the certificates.