Better SSH key management.

SSH is good, but too many KEYS!

Once the number of servers you have to manage reaches 5 or more, SSH keys will become a mess. Do I need to generate a new key pair for every machine? I don't want to upload keypairs to every server, and rotating them takes ages. This also imposes security threats. 

Overhaul, here are some ideas.

We need a big change. Here are goals I wish to achieve.

• Only ONE key and that's enough! 

• No key pairs on each server due to security concerns.

• Able to ssh back and forth between servers, no password required.

• Able to access GitHub/GitLab repositories with the same SSH key.

• WinSCP can access servers without a password.

• I will also cover the setup for Synology DSM, OpenWRT (dropbear).

What do we need?

	Windows	Linux
Key Generation	ssh-keygen, puttygen	ssh-keygen
PPK format	puttygen
Agent	ssh-agent, pageant	ssh-agent
Client	Putty, WinSCP	ssh, scp

For Linux, these usually come with distribution.

For Windows clients, please install Git for Windows and download puttygen and pageant here. Please uninstall OpenSSH client (win10) since it is not compatible with git and causes confusion.

What's a ssh agent?

An agent? As scary as it sounds, a ssh-agent acts like a single point of key authentication center. Every time an ssh server needs a key to authenticate a client, the server will speak with the center. (I may be wrong, but never mind.)

This saves me from bringing keys with me all the time, e.g. store dozens of keys on a server. 

THREE steps left

1. Generate a new keypair, and protect it with a password.

id_ed25519        is the private key.

id_ed25519.ppk is the private key used by Putty/WinSCP (if you use win)

id_ed25519.pub is the public key.

Generate using ssh-keygen

This will generate id_ed25519 and id_ed25519.pub.

Linux

$ ssh-keygen -t ed25519

Windows

Open a command line and run 'ssh-keygen -t ed25519'.

Use puttygen to convert the private key for Putty/WinSCP: id_ed25519.ppk.

Generate using puttygen

You may use puttygen too. Follow instructions here, here and here. 

2. Distribute the public key.

Add the content of the public key to ~/.ssh/authorized_keys on each server.

3. Run an agent on the client machine

• Windows

• Putty/WinSCP

Run pageant.exe and you may find it in tray icon area.

Add the .ppk private key to it. 

https://kerneltalks.com/howto/how-to-forward-ssh-key-in-putty/

• Git (Git Bash)

Open Git Bash

$ eval $(ssh-agent -s) 

https://killtheradio.net/how-tos/ssh-agent-on-cygwin/

• Linux

Add the following command to ~/.profile or ~/.bash_profile.

eval $(ssh-agent -s)

This will start a ssh-agent in an interactive login shell.

Try ssh to a server, then to another one, then to another one...I know, you get it.

Multi-hop

You may use ssh like before and it will handle the authentication for you.

client$ ssh -A srv1.domain.org

srv1$ ssh -A srv2.domain.org

srv2$ 

The ‘-A' enables forwarding of the authentication agent connection. 

Reference

ssh/sshd man pages

https://blog.aaronlenoir.com/2018/05/06/ssh-into-synology-nas-with-ssh-key/

https://openwrt.org/docs/guide-user/security/dropbear.public-key.auth

https://www.ct-networks.io/community/tutorials/setting-up-dropbear-public-key-authentication.html

https://unix.stackexchange.com/questions/120949/ssh-agent-forwarding-multiple-hop

https://superuser.com/questions/878943/how-to-use-putty-for-forwarding-keys

https://kerneltalks.com/howto/how-to-forward-ssh-key-in-putty/

https://www.ssh.com/ssh/keygen/