Editing Scanco Administration (section)

===SSH tricks===
====RSA and DSA Authentication====

The main advantage of setting up RSA authentication is that you will no longer have to type your password each time you access a host with ssh.  There are some technical reasons why RSA and DSA access is more secure than password access.

These instructions work on both Linux and OS-X.  

# Create your public/private key pair on your local computer
#* At the command prompt type: ssh-keygen -t rsa
#* You will be asked to create a passphrase.
#* This will create the files .ssh/id_rsa and .ssh/id_rsa.pub .  Once you have these files, you never have to repeat this step.
# Copy your public key contents into the .ssh/authorized_keys2 file on the remote server
#* You can email yourself the file .ssh/id_rsa.pub from the local computer.
#* You could do this: ssh username@remoteserver.com 'cat >> ~/.ssh/authorized_keys2' < /Users/Youruser/.ssh/id_rsa.pub
#* You can also use the ssh-copy-id utility: ssh-copy-id -i <path to public key> <destination>, e.g. ssh-copy-id -i ~/.ssh/id_rsa.pub fem@thegnu.ucalgary.ca

<u>NOTES ABOUT KEYS</u>
Remember, the "authorized_keys" file is a concatenation of public (id_rsa.pub) keys, 
and the "id_rsa" is the private key.  
Every user on every computer should only have ONE "id_rsa" file, 
but can have multiple "id_rsa.pub" files concatenated into
their "authorized_keys" file.

=====SSH Agent=====

SSH-Agent is a tool to store your passphrase so you don't have type it every time.

On OS-X, it is integrated into the system Keychain - you will be asked once if it should remember your passphrase, and after that you don't have to worry about it.

Most Linux systems also have ssh-agent configured to start with every session. You may however have to do this once:
 ssh-add ~/.ssh/id_rsa

If you find that after following the above steps to create a public-private key pair and add the public key to the destination machine, you still cannot connect or are prompted for the password, likely you need to use the above command to add your private key to your local ssh-agent.

====SSH Tunneling====

This is an alternative to VPN through kinesiology.  It may come in handy if for some reason VPN is not working.

If you're outside the university system and want to access, for example, svn on mike.kin, which is normally blocked by the university firewall, you can do that with ssh tunneling.  Here is an example:

 ssh eric@mighty-mac.kin.ucalgary.ca -L 2000:mike.kin.ucalgary.ca:443 -N

Here is what is going on:
* I want to access port 443 (which is https) on mike.kin.ucalgary.ca.
* I have an account on mighty-mac, so I'm using that server to create an ssh tunnel inside the university firewall.  I could use any machine I had an account on inside the university system, even mike.kin.ucalgary.ca, the one I'm trying to get to (in fact, that would be best, but for purposes of demonstration I'm using a different machine).
* I'm mapping the local port 2000 to port 443 on mike.  Anything I send to localhost:2000 will by sent by ssh or the ssh tunnel to mighty-mac, which will then send it on to port 443 on mike.
* 2000 is a random 4-digit port number.  If by some fluke you happen to choose one that is in use, ssh will complain and you will have to try another port number.

Now I can fire up my browser and point it to

 https://localhost:200/trac/

And what I get is the trac site on mike.

If I want to get the code, I can do this:

 svn checkout https://localhost:2000/svn/numerics88/trunk trunk_tunnel

("trunk_tunnel" is just the directory name where it will end up.  It can be named anything, but this will remind me that it only works when the tunnel is up.)


[[Image:Redirect.jpg|15px]] [[#top|''Return to Contents'']] or [[Main_Page|''Return to Main Page'']]