How to setup SSH keys

This brief tutorial explains how to generate SSH keys and publish them to a server. It’s been tested on Mac OS X Mountain Lion (10.8).

Objective
Generate an SSH key and upload them to a server. In our example, we’ll upload it to server.example.com.

Step #1
Launch Terminal.app and type:

ipanema:~ jdoe$ ssh server.example.com
The authenticity of host 'server.example.com (xx.xxx.xx.xxx)' can't be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:.

Type yes to add the host to your list of known hosts:

Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'server.example.com,xx.xxx.xx.xxx' (RSA) to the list of known hosts.

Enter the password. This will create an .ssh directory in your home directory with the proper permissions.

Password:
Last login: Tue Nov  6 20:33:46 2012 from xx.xxx.xx.xxx

Welcome to server.example.com.

This server is managed by the SEO Puppet configuration management system.
Local ad-hoc changes to this system are strictly discouraged.  Any files 
that contain an auto-generated header will be updated via puppet and local
changes will be overwritten.  Please contact admin@example.com for more info.

server:~ jdoe$

We can close the connection for now:

server:~ jdoe$ exit
logout
Connection to server.example.com closed.

Step #2
Now we’ll generate the SSH key:

ipanema:~ jdoe$ ssh-keygen -t rsa

This will prompt you for a secret passphrase:

Generating public/private rsa key pair.
Enter file in which to save the key (/Users/jdoe/.ssh/id_rsa): 
Created directory '/Users/jdoe/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /Users/jdoe/.ssh/id_rsa.
Your public key has been saved in /Users/jdoe/.ssh/id_rsa.pub.
The key fingerprint is:
15:db:96:0d:92:bc:51:4d:bf:d6:43:89:98:98:fb:c8 jdoe@ipanema.example.com
The key's randomart image is:
+--[ rsa 1024]----+
|         .oooo.  |
|          *=o+o..|
|         oo=+..o.|
|         .o.  . o|
|        S.     +.|
|        . o   . .|
|         E .     |
|                 |
|                 |
+-----------------+
ipanema:~ jdoe$ 

IMPORTANT
Always use a good passphrase and never leave it blank. If this works right you will get two files called id_rsa and id_rsa.pub in your .ssh directory.

Step #3
Now it’s time to upload the credentials to server.example.com:

scp ~/.ssh/id_rsa.pub server.example.com:.ssh/authorized_keys2

This command copies the id_rsa.pub file to the other host’s .ssh directory with the name authorized_keys2. Now server.example.com is ready to accept your ssh key.

How to tell it which keys to use?
The ssh-add command will allow us to confirm which SSH key will be used:

bash-3.2$ ssh-agent sh -c 'ssh-add < /dev/null && bash'
Identity added: /Users/jdoe/.ssh/id_rsa (/Users/jdoe/.ssh/id_rsa)

The moment of truth
Everything looks good, so let’s try to ssh into server.example.com once again. This time, no prompt should appear because the magic of SSH keys will take over:

bash-3.2$ ssh serverexample.com
Last login: Tue Nov  6 20:18:18 2012 from 17.226.33.162

Welcome to serverexample.com.

This server is managed by the SEO Puppet configuration management system.
Local ad-hoc changes to this system are strictly discouraged.  Any files 
that contain an auto-generated header will be updated via puppet and local
changes will be overwritten.  Please contact seo@example.com for more info.

server:~ jdoe$

Did you gain access without a prompt? If so, congratulations! Otherwise, start over and pay attention to the instructions ;-)