SSH. Introduction. SSH Private Key

Transcription

1 SSH 1. Introduction 2. SSH Private Key 2.1. How can I download my private SSH key 2.2. How can I get my private SSH key in PPK format? 3. How to connect to my server 4. How can I access my server as the root user? 5. SSH tunnel 6. Troubleshooting 6.1. The SSH warning: REMOTE HOST IDENTIFICATION HAS CHANGED 7. Give SSH access to the another person or your customer Create private/public keys Create a separate account Deleting the additional user account Use the 'bitnami' account Introduction SSH stands for Secure Shell Handler and is a protocol used to connect securely to a remote server and execute commands. It is the equivalent of opening a terminal window on the remote server. To connect to a BitNami hosted server, you will need a special file named "Private Key". SSH Private Key The most secure way to access your server via SSH is by using the SSH Key - password-based authentication is not secure. Each cloud account has an associated SSH key file ("Private key") that you can use to connect remotely to the servers launched using that cloud account credentials. This file needs to be protected, as anybody who has access to it can access your servers. On Linux and OS X, it is necessary to change the file's permissions, so it is only readable by you. chmod 600 bitnami-hosting.pem Otherwise you may get a 'bad permissions: ignore key' error.

2 How can I download my private SSH key Bitnami Cloud Hosting Go to the Servers section, select your server, click 'Manage Server' and use 'Connect' button. In case you don't have any servers, you can download his file going to Clouds > Manage, clicking on the appropriate cloud account. Click on the appropriate format to start the download: Select PEM format if you are going to connect from Linux, OS X or other Unix systems Select PPK for Windows Putty, FileZilla and WinSCP. bch_server_manage_connect2.png AWS Console It is not possible to download the SSH key from the Amazon EC2 Control Panel once it has been created. If you launched your server using the Amazon EC2 Control Panel and selected the option to generate a new key pair, it would have been available for download at that time. Tabs end Store the SSH key file in a secure place on your local machine! How can I get my private SSH key in PPK format? PPK is the private key format used by Windows programs Putty, FileZilla and WinSCP. Bitnami Cloud Hosting If you are a Bitnami Cloud Hosting client, you can download your key in this format directly: click "Connect" in "Server Manage" view and use "PPK" button. Others Otherwise, you will need to convert your downloaded key to PPK format as described here: htmldoc/chapter8.html#puttygen-conversions

3 putty-download.png putty-conversion.png putty-conversion2.png Tabs end How to connect to my server Windows & PuTTY The easiest way to log in to your cloud server is with PuTTY, a free SSH client for Windows and UNIX platforms. Download the SSH key for your server in.ppk format. Download the PuTTY ZIP archive from its website Extract the contents to a folder on your desktop. Double-click the putty.exe file to bring up the PuTTY configuration window. Obtain the IP address or host name of your cloud server by browsing to the Bitnami Cloud Hosting dashboard and signing in if required. Then, select the "Servers" menu item, select your cloud server from the resulting list and click the "Manage" button to obtain the server's host name and IP address. Enter the host name of your cloud server into the "Host Name (or IP address)" field, as well as into the "Saved Sessions" field. Click "Save" to save the new session so you can reuse it later.

4 In the "Connection SSH Auth" section, select the private key file (*.ppk) you saved in the previous step.

5 In the "Connection Data" section, enter the username 'bitnami' into the "Auto-login username" field.

6 Go back to the "Session" section and save your changes by clicking the "Save" button. Click the "Open" button to open an SSH session to the server. PuTTY will first ask you to confirm the server's host key and add it to the cache. Go ahead and click "Yes" to this request (learn more).

7 You should now be logged in to your cloud server. If you prefer to use PuTTY from the command line, you should include '-i' and '-l' options as follows: > putty -i "C:\Path\To\bitnami-hosting.ppk" -l bitnami xyz.bitnamiapp.com Remember to use the correct path to 'bitnami-hosting.ppk' in the previous commands, and to replace 'xyz.bitnamiapp.com' with the public IP address or host name of your server. Windows & MobaXTerm MobaXTerm is an enhanced terminal with an X server and a set of Unix commands (GNU/Cygwin) packaged in a single portable exe file. You can dowload it at: You will need to get your SSH key in PEM format. In this case it is not necessary to import your private key into the application, you can use it directly. You can copy files to the machine using the right panel or you can connect to the machine through SSH:

8 ssh -i private_key Linux and Mac OS X Linux and Mac OS X come bundled with SSH clients by default. Download the SSH key for your server in.pem format. Open a new terminal on your Linux or Mac OS X system. Set the permissions for your private key file to 0600 using a command like the one below: chmod 600 bitnami-hosting.pem Obtain the IP address or host name of your cloud server by browsing to the Bitnami Cloud Hosting dashboard and signing in if required. Then, select the "Servers" menu item, select your cloud server from the resulting list and click the "Manage" button to obtain the server's host name and IP address. Log in to the server using the following command: ssh -i bitnami-hosting.pem bitnami@xyz.bitnamiapp.com Remember to replace 'bitnami-hosting.pem' in the previous commands with the path to your private key file, and 'xyz.bitnamiapp.com' with the public IP address or hostname of your server. Your SSH client might ask you to confirm the server's host key and add it to the cache before connecting. Accept this request by typing or selecting "Yes" (learn more).

9 You should now be logged in to your cloud server. Tabs end How can I access my server as the root user? By default, you can only log in as the bitnami user to a BitNamibacked machines (VM, AWS, Azure or BitNami Cloud Hosting). Once logged in, you can use the 'sudo' utility to become the super user or execute. sudo su SSH tunnel If you want to connect to the local port which is not available from outside, you can use SSH encrypted tunnel. Assuming that your server application is running at the port 9990 and that you want to have access to it from your local port Windows If you are using Windows in your local machine you can create the tunnel as follows: Follow the steps to connect using Putty Before opening the connection. Go to Connection -> SSH -> Tunnels, enter the values below and click "Add" button: Source port: "9991" Destination: "localhost:9990" A different workaround is using "plink.exe" tool from the Windows command line. Download your private key in ppk format Download the "plink.exe" tool at download.html Open a Command Prompt, go to the folder where you downloaded the tool and the key and run the following command: plink.exe -i your_key.ppk -N -L 9991: :990 bitnami@xyz.bitnamiapp

10 Linux and Mac OS X If you are in Linux or Mac you can run the following in a console in your local machine (using your Public DNS instead of xyz.bitnamiapp.com): ssh -v -N -L 9991: :9990 -i bitnami-hosting.pem bitnami@xyz.bitna Tabs end While the tunnel is active you can connect to your server port 9990 at :9991 Troubleshooting The SSH warning: REMOTE HOST IDENTIFICATION HAS CHANGED It is normal when you are trying to connect to the same IP but the machine is different, for instance when you assign the static IP address to another server. You can fix the problem by removing the IP address (you are trying to connect) line from your ~/.ssh/known_hosts file. If you use Putty, then ssh key mismatch warning looks like below: WARNING - POTENTIAL SECURITY BREACH! [...] In this case click Yes, if you know the reason for the key mismatch (IP address assigned to another server, machine replaced, etc.) Give SSH access to the another person or your customer You should ask your customer to send to you his own public ssh key generated on Linux/Unix/OS X, this way you can give him an access to your machine without sharing your or his private key.

11 Create private/public keys If the person to whom you are going to give access doesn't have a private/public key pair yet, he should generate them as described below. On Windows he can use PuttyGen. This page explains the process in detail. On a Linux/Unix/OS X machine he should use the ssh-keygen command.. ssh-keygen -b t rsa -f ~/newuser_id When executing this command you will prompted to enter a passphrase to protect the private key. This command will generate two files: newuser_id: This is the private key. It is personal and your customer should not share it with anyone else. He will use it to access your machine. newuser_id.pub: This is the public key. It is the file that your customer will share with you so you can give him access to your machine. Copy this file newuser_id.pub to your server. Now you have two options: you can create a separate account for him (RECOMMENDED) or just allow him to log into the server using the 'bitnami' account Create a separate account First you need to connect to your machine as "bitnami" user via SSH. More info how to do so at this wiki page. Once you are logged in, to create a new user that will share the same user privileges as "bitnami", you could use the command below: sudo useradd -s /bin/bash -o -u `id -u` -g `id -g` new_username

12 That will create an alias user for "bitnami". That means it will be able to write into directories such as htdocs or use sudo. Now you can configure ssh access for that user. To do that, you can simply copy the bitnami.ssh folder to the new user home directory: sudo mkdir ~new_username/ sudo cp -rp ~bitnami/.ssh ~new_username/ sudo cp -rp ~bitnami/.bashrc ~new_username/ sudo cp -rp ~bitnami/.profile ~new_username/ Now you should add the content of the newuser_id.pub file in the /home/new_username/.ssh/authorized_keys file. cat ~/newuser_id.pub >> /home/new_username/.ssh/authorized_keys If you want another person to access your machine using this same account you just need to repeat this last step to add his public key in the authorized_keys file. If you want that you user is able to run commands as root user, it is necessary to add your new user to the "bitnami-admins" group. Run the following command as "bitnami" user in your machine: sudo usermod -G bitnami-admins new_username Deleting the additional user account The account created following the instructions above shares the same ID that the bitnami user account. If you want to delete this account you need to execute the following command: sudo userdel new_username -f You can confirm that the account has been successfully removed by executing: id new_username Use the 'bitnami' account Backup your old authorized_keys: cp /home/bitnami/.ssh/authorized_keys /home/bitnami/.ssh/authorized_keys.

13 Add your customer public key to authorized_keys (PLEASE BE EXTREMELY CAREFUL to avoid losing ssh access at all) cat ~/newuser_id.pub >> /home/bitnami/.ssh/authorized_keys Now you both are able to access the machine as "bitnami". You can revert the changes by removing the last line from the /home/ bitnami/.ssh/authorized_keys file or by restoring the old authorized_keys file: cp /home/bitnami/.ssh/authorized_keys.bak /home/bitnami/.ssh/authorized_k