1 00:00:06,639 --> 00:00:10,269 In this video you'll learn how to configure a keybase SSH login. 2 00:00:11,429 --> 00:00:17,420 So by default, SSH access is based on username and password, but password is not very secure. 3 00:00:17,980 --> 00:00:21,410 So for enhanced security you should consider using key based access. 4 00:00:22,109 --> 00:00:25,769 Because a key can never be guessed, it needs to be stolen, and that's more complex. 5 00:00:26,589 --> 00:00:32,530 So in the process of configuring keys, the user creates a key pair, and next the public key is 6 00:00:32,530 --> 00:00:38,469 copied over to the SSH host, and for additional protection, the key may even be protected with a passphrase. 7 00:00:39,429 --> 00:00:43,734 So you use SSH keygen to create the key pair and SSH 8 00:00:43,734 --> 00:00:48,039 copy ID to copy over the key to the remote host. 9 00:00:48,880 --> 00:00:52,865 If you're interested in SSH key passphrases, then you 10 00:00:52,865 --> 00:00:56,850 should enter the passphrase while generating the key. 11 00:00:57,750 --> 00:01:02,530 Now, entering a passphrase on initialization of every session is annoying, and that is 12 00:01:02,530 --> 00:01:07,310 why you can automate that using SSH agent on Bin Bash that will run 13 00:01:07,310 --> 00:01:12,090 the SSH agent, which can cache the passphrase for the session duration. 14 00:01:12,969 --> 00:01:15,890 The result is that you only have to enter your passphrase once. 15 00:01:16,950 --> 00:01:21,230 And next the ssh add command can be used to add the current key to the agent. 16 00:01:21,879 --> 00:01:25,280 And that is kind of cool. Let me show you. 17 00:01:26,480 --> 00:01:32,780 So I'm on my CentOS machine here, and I'm using SSH keygen to generate the public private key pair. 18 00:01:33,719 --> 00:01:37,959 So this is asking for the file that I want to use to save the key. 19 00:01:38,560 --> 00:01:41,099 The key is a private key, you should keep it secretly. 20 00:01:41,859 --> 00:01:45,099 And then we have the passphrase for this private key. 21 00:01:45,599 --> 00:01:50,694 And if you don't want to use a passphrase, let's do that for a start. Then you press enter and 22 00:01:50,694 --> 00:01:55,789 enter again for the empty passphrase. And now it has created the private key as well as the public key. 23 00:01:56,409 --> 00:02:00,109 And I'm going to use SSH copy ID to Ubuntu. 24 00:02:02,549 --> 00:02:08,830 This is prompting me for use student at Ubuntu's password, because right now we haven't 25 00:02:08,830 --> 00:02:15,110 set up any key based authentication, so I really need to enter the password. 26 00:02:15,930 --> 00:02:22,356 So now that the public key has been copied over, I can use SSH to Ubuntu again. And look 27 00:02:22,356 --> 00:02:28,783 at that. I'm not prompted for anything now, as I told you, that's a little bit insecure, so we 28 00:02:28,783 --> 00:02:35,210 need to go for a different approach. I'm using SSH keygen again and I'm overwriting the val. 29 00:02:35,270 --> 00:02:39,889 So yes, I want to overwrite and then I'm typing my very secret passphrase. 30 00:02:41,330 --> 00:02:45,715 The idea behind the passphrase is that even if somebody is stealing your 31 00:02:45,715 --> 00:02:50,099 SSH private key, they can't use it if they don't know the passphrase. 32 00:02:50,860 --> 00:02:56,789 That's what we call multi factor authentication and that's much more secure than single factor authentication. 33 00:02:57,669 --> 00:03:02,969 Now I'm using SSH copy ID to copy the key over to the other host. 34 00:03:04,889 --> 00:03:09,694 Now I'm going to use SSH Ubuntu once more and oh, 35 00:03:09,694 --> 00:03:14,500 it wants to enter the passphrase to unlock the private key. 36 00:03:15,180 --> 00:03:18,469 Now this is nice. We have the graphical user interface kicking in. 37 00:03:19,310 --> 00:03:21,969 And you know what? I can even cache it right here. 38 00:03:23,050 --> 00:03:28,830 Here I'm clicking this option automatically unlock this key whenever I'm logged in. Then I'm clicking Unlock. 39 00:03:30,129 --> 00:03:36,819 Next time that I'm typing Exit and I'm connecting again, it will automatically connect. 40 00:03:37,580 --> 00:03:43,143 That means that because of this advanced feature in the GNOME graphical interface, I don't 41 00:03:43,143 --> 00:03:48,706 need to use SSH Agent and SSH Add, that's command line only. So I can 42 00:03:48,706 --> 00:03:54,270 show you that I've already taken care of secure configuration of key based authentication.