I read about setting up ssh keys in Linux and have some questions. Correct me if I'm wrong…
Let's say host tr-lgto wants to connect to host tr-mdm using ssh. If we want to be sure that it's the real tr-mdm, we generate a pair of keys on tr-mdm and we add the public key to known_hosts
on tr-lgto.
If tr-mdm wants to check that it's the real tr-lgto, then tr-lgto has to generate a keypair and add the public key to authorized_keys
on tr-mdm.
Question 1: There is no user field in file known_hosts, just IP addresses and hostnames. tr-mdm might have a lot of users, each with their own .ssh
folder. Should we add the public key to each of the known_hosts
files?
Question 2: I found that ssh-keyscan -t rsa tr-mdm
will return the public key of tr-mdm. How do I know what user this key belongs to? Moreover, the public key in /root/.ssh/
is different from what that command returns. How can this be?
Best Answer
You're mixing up the authentication of the server machine to the client machine, and the authentication of the user to the server machine.
Server authentication
One of the first things that happens when the SSH connection is being established is that the server sends its public key to the client, and proves (thanks to public-key cryptography) to the client that it knows the associated private key. This authenticates the server: if this part of the protocol is successful, the client knows that the server is who it pretends it is.
The client may check that the server is a known one, and not some rogue server trying to pass off as the right one. SSH provides only a simple mechanism to verify the server's legitimacy: it remembers servers you've already connected to, in the
~/.ssh/known_hosts
file on the client machine (there's also a system-wide file/etc/ssh/known_hosts
). The first time you connect to a server, you need to check by some other means that the public key presented by the server is really the public key of the server you wanted to connect to. If you have the public key of the server you're about to connect to, you can add it to~/.ssh/known_hosts
on the client manually.Authenticating the server has to be done before you send any confidential data to it. In particular, if the user authentication involves a password, the password must not be sent to an unauthenticated server.
User authentication
The server only lets a remote user log in if that user can prove that they have the right to access that account. Depending on the server's configuration and the user's choice, the user may present one of several forms of credentials (the list below is not exhaustive).
~/.ssh/authorized_keys
on the server).