{"id":305,"date":"2010-06-05T06:07:17","date_gmt":"2010-06-05T12:07:17","guid":{"rendered":"http:\/\/blog.supportpro.com\/2010\/06\/openssh-public-key-authentication\/"},"modified":"2026-06-26T03:00:17","modified_gmt":"2026-06-26T09:00:17","slug":"openssh-public-key-authentication","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/openssh-public-key-authentication\/","title":{"rendered":"OpenSSH Public Key Authentication: How to Set Up Passwordless SSH Login"},"content":{"rendered":"

Public-key authentication is is based on the use of digital signatures. Each users have to create a pair of keys. ie public key and private key. Private key is owned by user and the public key is given to the server. When the user tries to authenticate, server check for the matching public key and sends a challenge to the user. Private key is used to authenticate the user, so never provide your private keys to others. If anyone got your private key, they can login to the server as you. So keep your private key file in a secure place and make sure that no one else has access to it.<\/p>\n

Secure Shell (SSH) public key authentication is used for clients to acess servers without using passwords.<\/p>\n

Steps to configure public key.<\/p>\n

OpenSSH is the SSH software installed on the client system. The ssh -V will show the openssh details in the server.<\/p>\n

$ ssh -V<\/p>\n

OpenSSH_3.6.1p1+CAN-2003-0693, SSH protocols 1.5\/2.0, OpenSSL 0x0090702f<\/p>\n

If ssh is running on a non standard port, you need to put the custom port. You can provide the custom port as follows.<\/p>\n

$ ssh -p 1111 server.test.com<\/p>\n

or<\/p>\n

$ ssh -oPort=1111 server.test.com<\/p>\n

RSA key pair will be generated in the client system.Public key will be provided to the server that is to be connnected, while the private key should remain in the secured area in the client system.By default it will be in ~\/.ssh\/id_rsa<\/p>\n

New keys can be generated using the command ssh-keygen<\/p>\n

client$ mkdir ~\/.ssh<\/p>\n

client$ chmod 700 ~\/.ssh<\/p>\n

client$ ssh-keygen -t rsa<\/p>\n

Enter passphrase<\/p>\n

Enter same passphrase again:<\/p>\n

File permissions should be protected to prevent other users from being able to read the key pairs.OpenSSH may refuse to support public key authentication if the file permissions are too open.<\/p>\n

$ chmod -R 700 ~\/.ssh<\/p>\n

Public key must be copied to any servers that will be accesses by the client.Public key information to be copied should be located in the ~\/.ssh\/id_rsa.pub file on the client. Public key data must be appended into ~\/.ssh\/authorized_keys file on the servers.<\/p>\n

First upload public key from client to server<\/p>\n

Client$ scp ~\/.ssh\/id_rsa.pub root@server.test.com<\/p>\n

Setup the public key in the server<\/p>\n

server$ mkdir ~\/.ssh<\/p>\n

erver$ chmod 700 ~\/.ssh<\/p>\n

server$ cat ~\/id_rsa.pub >> ~\/.ssh\/authorized_keys<\/p>\n

server$ chmod 600 ~\/.ssh\/authorized_keys<\/p>\n

We should always append new public key data to the authorized_keys file, as multiple public keys may be in use. Each public key entry must be on a different line<\/p>\n

“from” statement can be used before public key entries in the ~\/.ssh\/authorized_keys file on the servers to limit where the client system is permitted to access the server from. Without a from limit, any client will the appropriate private key data will be able to connect to the server from anywhere. Key pair should only work, if the client connecting to the server is from a host under test.com, set from=”*.test.com” before the public key data.<\/p>\n

server$ cat ~\/.ssh\/authorized_keys<\/p>\n

from=”*.test.com” ssh-rsa AAAAB3NzaC1<\/p>\n

Multiple hosts or addresses can be specified as comma separated values.<\/p>\n

from=”*.test.com,,external.example.com”<\/p>\n

If you require help, contact SupportPRO Server Admin<\/a><\/p>\n

\"Server<\/a><\/span>