SSH key handling

If you have to work with servers, especially with Linux ones, sooner or later you'll have a confrontation with SSH.

I'll give here some tips and tricks I used so far.

Force user and port for certain servers

When you try to login into a server, by default ssh uses your username and port 22 by default.
But maybe you need to use always another user name or another port.
You could specify this always as parameters for ssh:

ssh -p 22022 [notme@]server-ip

But it is much easier to configure your ssh client to these by default.
Therefore, you just add the following to your ~/.ssh/config file:

host server-ip another-server-name
Port 22022
User notme

host *
User root

You can put here as many hosts with different parameters as you want, '*' is also supported for creating regular expressions.

Change order of authentication methods

There's a another very useful parameter that you might want to add to your server configurations:

host *
User root
PreferredAuthentications publickey,password

This would only allow to use keys or passwords and prevents to use other methods which might not work in your setup and slow down connection attempts.
Put this whenever you notice that it take several seconds to log into a server.

Copy your own key to server

This used to be the first step I do, whenever I access a certain server several times.
So I don't have to give the password each time I access the server.

# Copy my machines public key to the server (will prompt for password):
ssh-copy-id [user@]server-ip

# Unfortunately, ssh-copy-id only works with SSH port 22, so if you have to specify another
# one, you might use this instruction:
ssh-add -L | ssh -p22022 [user@]server-ip "umask 077; test -d ~/.ssh || mkdir ~/.ssh ; cat >> ~/.ssh/authorized_keys"

# Verify the granted access (now without password prompt):
ssh [user@]server-ip
# or when copying
scp afile.txt server-ip:test/ 

Fix non-working ssh public keys

Sometimes, the sshd server doesn't accept a previous copied ssh-key (ssh-copy-id). In that case, make sure you have the following configuration in /etc/ssh/sshd_config

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

# If it still doesn't work apply the correct permissions to folders and files:
# chmod go-w ~
# chmod 700 ~/.ssh
# chmod 600 ~/.ssh/authorized_keys

# If it still doesn't work, then disable the permissions checking:
StrictModes no

Restart the ssh daemon again after applying this new configuration.

Debugging and sorting out further problems

The permissions of files and folders is crucial. You can get debugging information from both the client and server. if you think you have set it up correctly, yet still get asked for the password, try starting the server with debugging output to the terminal. /usr/sbin/sshd -d
To connect and send information to the client terminal ssh -v ( or -vv) username@host's

Remove authorized keys

If you have hundreds of keys in your machines ~/.ssh/authorized_keys and you're to lasy to edit that by hand, these one-line shell commands maybe handy.
Just use sed to rip out anything which doesn’t match the regex pattern (for example machine names, part of the hash, whatever:

# rip out anything which doesn’t match the regex pattern
sed ‘/your host name/ ! D’ -i.old ~/.ssh/authorized_keys

# or something more complicated
sed ‘/\(host1\|host2\)/ ! D’ -i.old ~/.ssh/authorized_keys

# with many patterns it is easier with this command
cp ~/.ssh/authorized_keys{,.old} && for p in pat1 pat2 pat2 ; do sed '/$pat1/ ! D' ~/.ssh/authorized_keys ; done

Just the ones specified will be maintained, a backup file will be created.
If you want to do the opposite, remove some specific keys and let the rest untouched:

sed ‘/\(host1\|host2\)/ D’ -i.old ~/.ssh/authorized_keys