Difference between revisions of "AWS/Connect over SSH to EC2"

From Ever changing code
< AWS
Jump to navigation Jump to search
Line 1: Line 1:
= Quick guide to connect password-less from Windows Putty to Linux OpenSSH =
= Quick guide to connect password-less from Windows Putty to Linux OpenSSH =
#Run PuTTYgen.exe and generate a key
#Run PuTTYgen.exe and generate a key
#Select and copy the public key. It's already in OpenSSH format
#Copy the public key into clipboard. It's already in OpenSSH format
#Login to Linux box and append the key to new line of ~/.ssh/authorized_keys file <code><br> vi ~/.ssh/authorized_keys <br> chmod 600 ~/.ssh/authorized_keys #change permissions if the file did not exist</code>
#Login to Linux box and append the key to <code>~/.ssh/authorized_keys</code> file<br><code>vi ~/.ssh/authorized_keys<br>chmod 600 ~/.ssh/authorized_keys #change permissions if the file did not exist</code>
#Save the file
#In PuTTY save the private key on a disk as .ppk file
#From PuTTY save the private key on a disk, it will be .ppk file
#Double click on it to load into Pageant (key agent)
#Double click on it to load into Pageant (key agent)
#Open Putty and connect with your user password less.
#Open Putty and connect to the remote linux box.


The key pair authentication is automatic lookup of matching authorized keys. The key it self does not contain any encoded information like user name or host name, the comment field is arbitrary description not taken into account when connecting.
The key pair authentication is automatic lookup of matching authorized keys. The key itself does not contain any encoded information like user name or host name, the comment field is arbitrary description not taken into account when connecting.


;The connection will success as long:
;The connection will success as long
* the private key is specified in Putty session or loaded in Peagant key agent
* the private key is specified in Putty session or loaded into Peagant key agent
* the public key is on the list of ~/.ssh/authorized_keys where matching lookup process authenticate the connection
* the public key is in <code>~/.ssh/authorized_keys</code> file on a remote server where the matching lookup process authenticate the connection


;Visual 6 quick steps to connect
;6 visual steps to connect
[[File:Quick-putty-connect-passwordless.PNG|none|left|Quick-putty-connect-passwordless]]
[[File:Quick-putty-connect-passwordless.PNG|none|left|Quick-putty-connect-passwordless]]



Revision as of 18:27, 18 May 2016

Quick guide to connect password-less from Windows Putty to Linux OpenSSH

  1. Run PuTTYgen.exe and generate a key
  2. Copy the public key into clipboard. It's already in OpenSSH format
  3. Login to Linux box and append the key to ~/.ssh/authorized_keys file
    vi ~/.ssh/authorized_keys
    chmod 600 ~/.ssh/authorized_keys #change permissions if the file did not exist
  4. In PuTTY save the private key on a disk as .ppk file
  5. Double click on it to load into Pageant (key agent)
  6. Open Putty and connect to the remote linux box.

The key pair authentication is automatic lookup of matching authorized keys. The key itself does not contain any encoded information like user name or host name, the comment field is arbitrary description not taken into account when connecting.

The connection will success as long
  • the private key is specified in Putty session or loaded into Peagant key agent
  • the public key is in ~/.ssh/authorized_keys file on a remote server where the matching lookup process authenticate the connection
6 visual steps to connect
Quick-putty-connect-passwordless

Theory: private and public keys

Ssh protocol can authenticate a user without password by using a private key that is matching a public key installed on a remote server.

OpenSSH - secure keys management

Each user home has ~/.ssh/ hidden subdirectory with files:

-rw-r--r-- authorized_keys #contains a list of public keys (the contents of id_rsa.pub) one per line that are allowed to 
                               login with the corresponding private key (the id_rsa file)
-r-------- id_rsa          #contains the user private key on the current system
-rw-r--r-- id_rsa.pub      #contains public key that can be copied/(append to authorized_keys file) on another system
                               allowing ssh logon without password
-rw-r--r-- known_hosts     #contains PUB keys of hosts you connected at least once. If the key is not in you will be prompted:
                           ECDSA key fingerprint is 0b:4e:13:85:4d:d2:1c:09:b8:6e:4c:20:04:76:c1:bd.
                           Are you sure you want to continue connecting (yes/no)?

Command ssh-keygen generates interactively a key pair of 2 files in default ~/.ssh location

  • id_rsa - private key, stays with us and should never be copied to another system
  • id_rsa.pub - public key, to be installed on remote system

You can add PUB keys to known_hosts file by

ssh-keyscan hos1 host2 host3 >> ./.ssh/known_hosts

Theory: ways to connect without password

  • You can use a private key id_rsa copied from a remote server to connect to the remote server.
  • Or you can append PUB key to authorized_keys file on a remote server and then use the matching private key to connect from a client.

It's worth to note that PuTTY and OpenSSH key files formats are not compatible although both are flat text files.

Download private key from EC2 Instance

Your OpenSSH key pair is generated at the time you build EC2 instance. The key pair name used for connection to the instance is listed under EC2 Dashboard > Network & Security > Key Pairs. You should have already downloaded a copy of the private key onto your local machine during the instance creation. The key pair used to connect to the specific instance is listed on the Instances screen > Key Pair Name:

Instance-keypair

Generate private PEM and public PUB key pair in Linux

The command below generates 2 files that make up a secure key pair, id_rsa file contains a private key and id_rsa.pub file is a public key. During the key generating you will be prompted for passphrase that can add extra layer of security but it can be ignored by pressing [enter] twice. You should also change a file permissions of the private key to read_only by the owner as per Getting Started with Amazon EC2 Linux Instances

ssh-keygen             #generates RSA key pair using defaults
chmod 400 id_rsa.pem   #makes readable only by the owner
-r------- 1 user user 1766 Aug 18 01:17 mykey.pem

Password less login - Linux to linux - install public key onto a remote system

For a password less login we need to append public PUB key to a remote system ~/.ssh/authorized_keys file. The public key was generated on our local Linux machine usually has .pub extension. Openssh using ssh-keygen command names creates id_rsa.pub file that contains the public key. The content of this file needs to be added to a remote system ~/.ssh/authorized_keys file. We have two options to achieve this:

Option 1 - append the key manually

From a local Linux box copy a public key over to the remote host

scp ~/.ssh/mykey.pub ubuntu@ec2-user@ec2-99-99-99-99.compute-1.amazonaws.com:/home/ubuntu/.ssh/

On a remote EC2 instance/linux append content of mykey.pub to ~/.ssh/authorized_keys file. This is known as installing the public key to a server.

ssh {ubuntu|ec2-user}@ec2-99-99-99-99.compute-1.amazonaws.com
cat ~/.ssh/mykey.pub >> ~/.ssh/authorized_keys
Option 2 - use ssh-copy-id command

This is so called installing identity by pushing our public key from the local machine by ssh-copy-id command that will append .pub key to the remote host ~/.ssh/authorized_keys file. It's important to use FQDN for the remote host

ssh-copy-id -i ~/.ssh/id_rsa.pub {ubuntu|ec2-user}@ec2-99-99-99-99.compute-1.amazonaws.com

Connect to the EC2 instance

EC2 default Linux usernames

  • Ubuntu user: ubuntu (confirmed)
  • RedHat user: root (tbc)
  • Amazon branded instances: ec2-user (confirmed)
  • CentOS user: centos (tbc)

Connect from Linux

ssh -i myprivkey.pem ubuntu@ec2-user@ec2-99-99-99-99.compute-1.amazonaws.com
 
    -l username      #specifies Linux account user name, in example above username ubuntu@ is used
    -v               #verbose mode

Connecting from Windows using PuTTY

PuTTY does not natively support OpenSSH private key format (.pem) generated on Amazon EC2 instance. This private key file is in a form called PEM – "Private Enhanced Mail". PuTTY cannot work with PEM files. PuTTY has a tool named PuTTYgen, which can convert keys to the required PuTTY format (.ppk). You must convert your private key into PuTTY format (.ppk) before attempting to connect to your instance using PuTTY.

Convert your PuTTY-gen private key to OpenSSH readable key
  1. Start PuTTYgen (All Programs > PuTTY > PuTTYgen).
  2. Under Type of key to generate, select SSH-2 RSA.
  3. Click Load. By default, PuTTYgen displays only files with the extension .ppk. To locate your .pem file, select the option to display files of all types(*.*).
    Import-pem-key-into-puttygen
  4. Change Key comment into your instance Key Pair Name made up by you when you created the instance's key pair.
  5. Click Save private key to save the key in the format that PuTTY can use. PuTTYgen displays a warning about saving the key without a passphrase. Click Yes. Note: A passphrase on a private key is an extra layer of protection, so even if your private key is discovered, it can't be used without the passphrase. The downside to using a passphrase is that it makes automation harder because human intervention is needed to log on to an instance, or copy files to an instance.
  6. Specify the same name for the key that you used for the key pair (for example, my-key-pair). PuTTY automatically adds the .ppk file extension.

Your private key is now in the correct format for use with PuTTY. You can now connect to your instance using PuTTY's SSH client.

Connect using a private key
  1. To do so, you need to specify a path to your private key first.
  2. Open PuTTY
  3. Navigate to Connection>SSH>Auth>Private key file for authentication (Browse...)
  4. Open location of the PPK file to be used for the connection
  5. Save the session
  6. Open the session to initiate the connection.

PuTTY Pageant - pre-load a private key for password less login

PuTTY Pageant is an agent that holds in a memory a list of private keys (PPK files). When you connect via PuTTY and type in a user name the agent (Pageant) is using matching key to log you in.

How to use Pageant

Double-click on the PPK file to load into PuTTY Pageant key agent that holds keys in RAM and use them for each connection you do using PuTTY

Pageant-key

On successful login in you will see message verifying that you authenticated using a key form an agent (read Pageant)

Log-in-with-pageant

Remove host from SSH known_hosts file

SSH in Linux stores fingerprints of authorized hosts that can connect to the system in ~/.ssh/known_hosts file. This file is used to detect if a host has changed or may have been compromised. However, recent OpenSSH versions hash the hostname in this file, which is good for security but means you can't just go in and edit the known_hosts file if you want to remove an entry (e.g. the server has been re-built and it now has new fingerprint). The command below will remove an entry for 'a hostname' from your known_hosts file. It also works with IP addresses.

ssh-keygen -R hostname

EC2 Security Group

Remember to assign the security group that applies to your scheme on your instance. Having port open on the instance does not mean you will be able to access from outside. It must bypass EC2 Security Group first. Overview below:

Ec2-security-group

References