Playing with Debian

Tuesday, 17th June 2008 at 01:18pm

Use private keys to protect your network

I'm usually on my laptop, using either my college or another unsecured wireless connection which makes me a little suspected about packet sniffers. I'm not too worried since I use SCP, which is encrypted, and SSH, which is also encrypted. Pretty good encryption too.

For you paranoid types though you can tighten up your encryption by using public key encryption. To really understand why it's a better encyption method, you need to understand how encryption works and that gets a little complicated. But, because your key is 100% random, and not based on a protocol like SSH or SSL, it's even awesomely harder to crack.

You can see how to set it up correctly so you can log in using it with WinSCP and PuTTY from HowtoForge, who have a big ass four-page article. Here's my short version:

  1. Nab the PuTTYgen executable.
  2. Run it and click "Generate". Then you just move your mouse around the blank area, below the bar, till the bar fills. What this is doing is taking the coordinates of your mouse every few millimeters and using them as random information bits to formulate the key. Totally unguessable.
  3. Change the "Key comment". I use this as a hint, since you get shown it whenever you try to log in using it. Don't make it too good a hint though, or the key'll become pointless.
  4. The key passphrase is your password.
  5. Save your public key, then save your private key.

That's your key generated. If you really want to, you can upload your public key; it doesn't matter if people know it. In fact, most people give it out so that people can send them encrypted messages (it's encrypted with the public key, and decrypted with the private key).

It goes without saying, but don't leave your private key lying around. I actually key mine on a flash drive, which is password protected.

Next, we need to tell your server abou the key.

Once you're logged into your server (probably for the last time without a key!), we need to make the directory ".ssh" (mkdir .ssh, so long as your on your home directory). Next, we need to make the key's file:

nano -w .ssh/authorized_keys2

Now, in the PuTTYgen window (I hope you didn't close it...) the first section gives you a chunk of text for "pasting into OpenSSH authorized_key files". Grab that, and copy it into the file we just made in nano. Save and exit nano.

Just a little bit of chmoding now.

chmod 700 .ssh

chmod 600 ~/.ssh/authorized_keys2

Now, close PuTTY and open it again. Head to Connection > SSH > Auth and put the location of you .ppk private key file. Now save that session information (head back to Session) and log in again. This time, you'll be promoted for your key phrase instead of your password.

Comments

Your name: Your URL:

Body:

Read some previous entries