How to connect with SSH client to EC2 service ?
I have the .pem file with *.ppk extension and structure:
PuTTY-User-Key-File-2: ssh-rsa
Encryption: none
Comment: imported-openssh-key
Public-Lines: 6
KEY ^ LINES
Private-Lines: 14
KEY LINES
Private-MAC: KEY
I have Putty
http://s017.radikal.ru/i400/1411/46/f11ad26d87e0.png
Do I have to upload this file in PuTTY?
But how to make it... PuTTY has no Open File dialog... What is the way ?
The common way of using PuTTY is in Host Name (or IP address) field to enter domain name.
For EC2 service that is Public IP I suppose.
I enter this value and have console opened, it propose to enter login...
I have no login, except from login to enter to EC2
--- my answer:
Hi, Thanks I found how attach .pkk file , but opened console again demands for login.
Also where to enter username as you wrote
after you specify your EC2 hostname and username
?
first you have to convert pem file to ppk by using puttygen, so after you will that ppk file use it under ssh auth give that file location and in hostname give ec2 instance name, it will allow you to login, user-name give ec2-user name if you are using linux, or check for the user-name according to your OS.
On the initial PuTTY Configuration window (after you specify your EC2 hostname and username), go to the Connection > SSH > Auth page and specify your .ppk key file in the Private key file for authentication box.
For more details, see:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.html
I'm assuming you have obtained the .ppk file by converting the .pem file downloaded when creating EC2 instance. You do not need to "upload" such .ppk file (or actually it's public part) anywhere as this is done automatically, when creating the EC2 instance. Had you generated the .ppk yourself, it's a different story.
Note that this it is NOT the .pem file with the .ppk extension. It's the .ppk file. It has nothing to do with the .pem anymore after converting.
Related
I was under the impression that the PEM file was just another public key as in SSH PubKeyAuthentication but I was completely wrong.
I didn't want to add the identity file in my ssh command each time, so I tried to do an ssh-copy-id into my azure vm so I can directly authenticate and log in with a simple ssh user#ip command
However, this command failed saying All keys were skipped because they already exist on the remote system. and when I checked /etc/ssh/sshd_config the PubKeyAuthentication line was commented out.
This led me to wonder, which line is enabling the IdentityFile/PEM key to be used to login?
Is it safe for me to enable PubKeyAuthentication on this public server?
Is PEM more secure?
In public key authentication, client has a private key that he uses to authenticate to server's public key.
There is no difference in security if you are using a private key (.ppk file) or a pem file to authenticate to your server.
I guess you are seeing something like this "#PubkeyAuthentication yes" in the sshd_config file, and this does not mean that it is commented out. It is a config file and this means that public key authentication has been enforced.
In short to answer your question, SSH with PEM file is no different from Public Key authentication (PKA). In PKA, you have the private key to yourself which you use to authenticate to the server's public key. With PEM file, it is nothing but the private key itself along with certificates. So, there is actually no such difference. You can convert a pem file to a .ppk file as well.
I am using Zabbix 4.0.
Trying to make a discovery rule for another remote linux server with SSH agent.
It asks for privatekey file and public key file. I understand it asks for privatekey file.
I put the private key file for remote server into the zabbix server .ssh director.
But why does zabbix also wants us to enter public key file. Privatekey file should be enough
to connect to remote server.
It is probably the public key of the server (aka hostkey), that is needed to verify that Zabbix is connecting to the legitimate server.
I have created a ssh key for my droplet at digital oceans. After few days I have deleted the key from security page and still I am able to ssh using putty with that key. Is it necessary to delete the key from authorized_keys file. If so, then what is the use of adding/deleting ssh keys to droplet on their above mentioned security page?
Question at digital ocean - https://www.digitalocean.com/community/questions/how-to-remove-ssh-keys-for-the-droplet
As the digital tutorial page says
"You can create new DigitalOcean droplets with an SSH key already set up on them by adding your computer’s SSH key to the control panel.".
To setup a ssh key for the droplet it is needed to add your newly created key to the droplet's control panel.
You are able to access the droplet even after you deleted the ssh from security page because now the ssh also resides inside your droplet's ~/.ssh/ folder(remote machine).
To authenticate using SSH keys, a user must have an SSH key pair on their local computer. On the remote server, the public key must be copied to a file within the user's home directory at ~/.ssh/authorized_keys. This file contains a list of public keys, one-per-line, that are authorized to log into this account.
When a client connects to the host, wishing to use SSH key authentication, it will inform the server of this intent and will tell the server which public key to use. The server then check its authorized_keys file for the public key, generate a random string and encrypts it using the public key.
So, it necessary to delete the key from authorized_keys file to stop ssh access to the remote machine.
After the droplet creation security page lists the keys just to show what all ssh keys you used for all your droplets.Deleting them from security page will not prohibit you from accessing your droplet.
I want to access to a server (hosted in Lonex) trough SSH (for file handling). For this I use PuTTY. To do so safely, I use Pagent, it needs a public and a private key.
In the server, under the ssh folder in the root directory there are two files:
id_rsa - which has the private key.
id_rsa.pub - which has a public key.
Given this information, if posible, I would like to generate the necessary files for Pagent.
What I have tried:
Using PuTTYgen to import/load a local copy of the file id_rsa. This successfully generated the the .ppk file needed for Pagent. I referred to the .ppk file in connection -> ssh -> auth. In this .ppk file appears the public and the private key. But when I use PuTTY to connect, having the generated .ppk added to Pagent, an alert prompts stating that I do not have the server's host key cached in the registry and then shows the server's rsa key fingerprint, which I know to not be the right one from the one shown in Pagent. The fact that this alert prompts tells me that my Pagrent key is not correct. Am I correct?
Comments:
- Given that the host already has a public/private key pair I believe I should generate a local private key given the same public key from the host. I could not accomplished this (I read about ssh-keygen commands but I did not find out how to get what I wanted done).
- The ISP suggested that everything I need is in this link: http://sourceforge.net/apps/trac/sourceforge/wiki/SSH%20keys#KeyGeneration:PuTTY
I could not find the use to it given that I do not have a form where I should place a public key generated locally by me and also the fact that it does not consider the situation where I already have a public key generated in the host.
- I asked the ISP if it was possible to add a public key generated locally by me to the authorized_keys2 file and they told me no due to the fact that it is a shared hosting.
Your question really boils down to this:
The fact that this alert prompts tells me that my Pagrent key is not
correct. Am I correct?
No; this is not correct. Your agent (Pageant) is likely set up correctly. As you said,
an alert prompts stating that I do not have the server's host key
cached in the registry and then shows the server's rsa key
fingerprint,
That prompt is for the server's host key, not your user's private key. Pageant only caches your user's private key, not the host's public key (or public key fingerprint). Pageant's purpose is to hold your private key so that the server can identify you; the purpose of the prompt that you saw was for PuTTY to allow you to verify that the server that you're connecting to is really the server you meant to connect to (i.e. that you're not connecting to an attacker's machine).
I set up an ec2 instance. In the security group, I opened up SSH 'tcp' port 80 for 0.0.0.0/0 (all open for testing purposes). I associated the instance with a private key. I downloaded the key and passed it while ssh-ing, but the RSA isn't authenticating. Any ideas?
ssh -i mykey.pem root#mydnsinfo.amazonaws.com
The authenticity of host 'mydns.amazonaws.com(IP)' can't be established.
RSA key finger print is FINGERPRINT
Are you sure you want to continue connecting (yes/no)?
Thank you in advance!!!
This is normal. Your SSH complains about the unknown host key. It always does when connecting to the new host for the first time. Just answer yes, connect and try again.
It should not complain for the second time.
The private key that you downloaded is for your 'root' account not for the whole host.
Securely configured EC2 instances will include the server SSH key fingerprint in the console output that you can access over SSL before you try to connect over SSH. Then when you connect over SSH you need to make sure the fingerprint matches the console. You MUST do this to be able to securely connect to public EC2 instances.
Public EC2 instances generate new server SSH key on each boot. This means that unless you do what I described above, you will be faced with unknown host key warning a lot, and if you ignore that warning you will be throwing security out of the door; you just never know where you will be connecting to.