Hello awesome people. In this lecture,
we are going to cover how we could
access a remote server without a
password using SSH key. Now a remote
server meaning, if we have a Linux
machine and we want to access another
Linux machine, that another Linux machine
for us is a remote machine. Now there
are two reasons that we need to access a
remote machine without a password. One
is repetitive logins, meaning if you
have a Linux machine A and you log into
a Linux machine B like 10 times or
20 times a day, and you don't want to
enter username and password again and
again, then you will generate SSH key.
Second reason, which is the more
important reason is automation through
scripts. If you have scripts run, that
are sitting on on your server A, and you
need to execute those scripts on server
B. So that is the automation that will
run on B, but every time you run it
from A to B, it will prompt for a
username and password. And of course,
this is an everyday thing and you don't
want to have any type of interaction
with it, so that is why you create SSH
key, so the automation will take place
by itself, without any human interaction.
Now keys are generated at the user
level. So you could generate keys like
your own self or as a regular user, in
my case, you could be generated as iafzal user,
or you could generate
the keys at the root level. So if you
want to log in from A to B through root,
you could also generate the keys for
root. So next time when you log in as
root, it's now going to prompt you for
username and password. Now let me put it
in a graphical way so this way I could
make you understand what are we trying
to achieve here. So let's say you have a
server or our Linux machine, and I'm
going to call it MyFirstLinuxVM.
And by the way, this is the actual host
name I have on my Linux machine. And
this machine wants to access another
Linux machine. And that host name of
that another Linux machine is LinuxCentOS7.
I have both of these Linux
machine set up and ready for me to do
this testing for this lecture. Now if
you have only one Linux machine at this
time, then you can either skip this
lecture or come back to it when you have
another second machine. I will recommend
you that you should build another Linux
machine and name it let's say cent
LinuxCentOS7 or whatever that you
want to call it, so you could actually
practice this lecture on the second
Linux machine. Anyway, now this client
which is my first Linux machine
wants to access the server LinuxCentOS7.
And it access it through SSH,
right. You open up PuTTY, you go from one
machine to another or from if you're
logged into the Linux machine, you can
run a command SSH to log into a remote
machine. When you log in, or when you
execute SSH command to remote machine,
the remote machine prompts you for two
things. Username and Password, right. So
you provide those username and password.
And then it will let you in.
Now the purpose of this lecture is what
if we wanted to log in without providing
the username and password. Now for that,
what you need to do is you need to
generate some keys on your client
machine. Meaning that is your
authentication that includes like your
ID or whatever, you generate those
keys that is a combined, a combination of
letters and keys and symbols. When you
generate them, you copy those keys over
to the server. And you tell the server
Hey, this is my authentication. So go
ahead and keep that key that I've
generated. Go ahead and keep it in your
authorized key file. Then once that is
copied over, the next time the client
tries to log in from MyFirstLinuxVM
to LinuxCentOS7 over SSH, then it
will not prompt that user for
username and password. Now that is how I
could put it and from machine to
machine. Now in a regular way, in
everyday life to make it more simpler, I
will give you a scenario of a user or
someone who wants to access a building
or a house. That person goes into the
house, and first thing they do is if
they don't have keys or access to that
house or that building, they ring a bell
or they meet the the security guard and
then they give them the authentication
and make sure it is verified and then
you come in. Now another way you could
do is, next time you want to come in,
you give some type of keys, like you
already go through your background
check, you already go through the
verification process, and then you give
those verification process to the
security team, or whoever homeowner of
that building, you give it to them. Then
next time when you come in, you don't
have you won't be prompted for using a
password. All you have to do maybe
flash your badge, or scan it and your in.
So, to come or to get
this process work, we have a few steps
that we need to follow. The first step
is on the client machine, the client
machine is the one that trying to go to
the server, we have to generate the
keys. And for that, the command we'll run
is ssh-keygen. The second step is
copy that key to the server. And the
command you use is exactly this
command, which is ssh-copy-id root,
because you generated the
keys as root, so you specify as root@
the IP address of the server where you
copying it to. Then login from the
client to server. Now since you
already copied over, now go ahead and try
to log in to the server using the
command like ssh root @ the IP address
of the server or ssh -l root and the
IP address of the server. Both commands
are the same, they actually
let you enter from one machine to
another or the account route. All right.
Now enough talking, let's go and login
to my Linux machines, and I will go
ahead and try this process. Now I have
my PuTTY terminal open. This first
machine is MyFirstLinuxVM, and if you
do hostname MyFirstLinuxVM , and if
you do, whoami, I'm logged in as root.
Now, what is my IP address? I could do ifconfig
enp0s3 is the interface
where I have my IP address. And you will
see my IP address of my client is
192.168.1.95. Now, I wanted to go
to my server. This is my server, its
host name is LinuxCentOS7. And I
am logged into that host as root. And
the IP address of the server is 0s3, I'll do
the same thing. And my IP
IP address of the server is 192.1681.58.
Now from the client, if I log in
to the server using the command ssh root
@ the IP address of the server, and hit
enter, you see it's prompting me for the
password. That's what we wanted to
avoid. So I'll just Ctrl C and get out
of it. Now I'm back into my client
machine which is MyFirstLinuxVM.
Now go ahead and clear the screen. So
this way we could start and run the
command in the client, ssh-keygen.
[No audio]
Hit enter. It is going to tell you
Generating public/private rsa key pair.
If you want to know more about RSA, RSA
is a mechanism of our authentication
level. If you wanted to learn more about
it, go ahead and search for it. Enter
file in which to save the key. Now by
default, it is going to save the key in
this directory. But wait, this directory
is on the client, on it's local machine.
If you want to change this location, you
could specify here, but I would
recommend you you leave it default and
just simply hit enter. Next step is
asking you to Enter passphrase (empty for
no passphrase). Now if you are in a
production environment, in the corporate
environment, I recommend you to put in a
passphrase anything that you like, could
be a password or anything, a combination
of letters. But we are doing this test
in a lab environment. So I'm not going
to pick any passphrase. So I'll just
leave that empty and simply hit enter.
it's prompting me again saying, Enter
same passphrase again, so I didn't enter
anything, so I'm not going to enter it
again, so simply hit enter again. Now
it's saying your identification has been
saved in /root/.ssh/id_rsa.
So if you cat this file, you're
gonna see the key as this is the key.
And your public key has been saved in
/root/.ssh/id_rsa.pub,
which is public. This is a key. Now what
we need to do is, we have already
authenticated ourselves, we have
generated the keys, now we need to copy
this key to our server, so this time, so
next time when I log into the server,
the server would know, and it says, oh, yeah,
I know you, I have your key. So you
could come in without a password. So I
have to copy that key. So to do that, I
will do ssh-copy-id root is the
root account that is on this server.
It's not the root on this client. So
root@ the server IP 192.1681.58. You
can right click if you're using PuTTY,
and it will copy it for you. Now hit
enter. Now, it is going to actually ask
you for the password because you are
going in for the first time. And of
course, once you add that key, it's
going to ask you that as just the last
time, so go ahead and put in a password
for that root account. And now it's
saying that, the keys has been
copied. And now it's saying now try
logging into the machine with, ssh
root@192.168.1.58. It
remembers my server and check to make
sure that only the key you wanted were
added. By the way that key is added to
this server, and it is added to root
.ssh authorized keys. You could
actually go into that, that directory
/root/.ssh, do ls -l, and you're
gonna see authorized keys. When you do
cat on that authorized keys, you're
going to see this is this entire key has
been copied. And it's copied as root
from the machine, MyFirstLinuxVM, so
it's already there. Now if I come in
from this machine to this machine, I'm
not going to have any problem or it's
not going to prompt me for using that
password. Let's go ahead and clear the
screen here. And let's go ahead and
clear the screen here. And now let's go
ahead and log into my server ssh root
@192.168.1.58, 58 is the IP of my
server. Let's try again to confirm you
see 58. Okay, now let's go ahead and
enter. Bingo. See I am logged in. It
didn't prompt me for any username. It
didn't prompt me for any password. And
I'm logged in. And if you do hostname,
you're going to see I am in,
LinuxCentOS7, which is this machine. You
could also do the other command exit
out. Now you back into your client,
MyFirstLinuxVM , you could do the second
command ssh by the way both commands
performs the same function 192.168.1.58.
And I'm logged in to the LinuxCentOS7
So that's how the logging
into a remote machine without password
works. You have to generate the keys on
the machine that is trying to log in,
give these keys to the server where
you're trying to log into. And then once
these keys are passed over, you could
try next time you log in, it's not going
to prompt you for any username or
password. And then you can run many many
different automated scripts and commands
without the nuisance of going in and
putting in the username password.
Anyway, I hope this lecture serves this
purpose. If you have any questions, let
me know. Good luck.