<p>As of the server move in spring 2019 you need authorisation on the expo server to log in. This takes the form of an ssh key. You generate a key-pair on the machine you use for access, then send the public half to the server. Once done all logins are automatic - no passwords needed.</p>
<p>You will need to run ssh-keygen/PuTTYgen on your device, email the public key to someone who already has ssh access (Wookey, Paul Fox, Philip Sargent, Sam Wenham). Once installed by them you should be able to log in as 'expo' over ssh (and other software like git will also use this behind the scenes). This only needs doing once (for any machine you want access from).</p>
<p>A public key file looks like this: <tt>ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApc9+PAMrDtWa8D8/ZneLP2X9UOYmTITAhTd2DRs8SE+NDgis5pYo/Xhtbrg86ePMAC2YM5xAkYx3jNA/VZ/PkB3gTzYJW3T/zTH+cc7YeWhy9l1zIMaYqeyvw7FxeSBaR4XoLPVtVUlai8DUDiWAEm7VvOKj1n68z1LxVh1MZXLm7btckf6fske2YU9UpjqT++AURQvFheRJ4la7KBJ7LXZ3A/TQ7HQaTpqmcQKCiRj/yZ5FNHxBk0M+ShbHUtz1GhXRCMJ3LZHaw24OJyVJ8YNzBiStBb1qcWCXX7HR9CUNhz7tA5HZyc1lau/1vwk8MSe93lyyLntzJKkqmkW/cQ== wookey@kh</tt>i.e. a long string of characters with 'ssh-rsa' at the start and an ID at the end (often 'user'@'machine').</p>
<ahref="https://www.ssh.com/ssh/putty/windows/puttygen">puttygen</a>, which is part of <ahref="https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html">PuTTY</a>. You need to install that if you don't already have it.</p>
<li>Save the private key (this will create a .ppk file that you will need later)</li>
<li>Don't save the public key - instead copy all of the text from the 'Public key for pasting
+into OPENSSH authorized_keys file' field, and paste that into the email. Make sure not to miss part or add newlines or otherwise mess with it.</li>
<li>Run Pageant (it will have been installed in your Start menu, otherwise find it it "C:\Program Files\PuTTY\pageant.exe"). Click the "Add Key" button. Select the .ppk file in the pop-up file list. You only need to do this once.
<li>You need openssh-client installed - it's it extremely likely to already be installed. If not (as root/with sudo) <tt>apt install openssh-client</tt>.</li>
<li>You may already have a key on this machine. If you already have <tt>~/.ssh/id_rsa.pub</tt>, then send that.</li>
<li>If not, run <tt>ssh-keygen</tt>. It may ask about passwords: you can add a password for extra
security, but a passwordless key is fine, and more convenient.</li>
<li>That will create a file: <tt>.ssh/id_rsa.pub</tt> in your home directory. Email that file to one of the admins listed above. </li>
<li>Install the <ahref="https://play.google.com/store/apps/details?id=com.server.auditor.ssh.client&hl=en">Termius app</a>
which is a ssh client. The free version does ssh but not sFTP. Follow the <ahref="https://docs.termius.com/">Termius documentation</a> and in-app help to generate a key pair and then use the same process to upload the public key to the expo server as for Linux machines, i.e. email it to an admin.
</li>
</ul>
<h3>iOS</h3>
<ul>
<li>There is apparently a version of the <ahref="https://play.google.com/store/apps/details?id=com.server.auditor.ssh.client&hl=en">Termius app</a>
for iPhones. Please try it out and document it here.
<p>OK, you have an uploaded and usable key and you can ssh into the expo server. If you want to connect from another machine (e.g. your phone) it's better to make another key than try to re-use the first one. You don't need a nerd admin now, you can do this yourself. But be <b>extremely careful</b> to follow this exactly. If you innocently rename the files to something that appears more sensible it won't work.
<li>On your new machine, generate a key-pair. Since you are probably using a different operating system on your second machine, read the instructions above for the relevant OS. Yes you will be generating a new key. Do not re-use the key you had already.
<li>This time though, you will want to be sure that the key has a meaningful label. On Linux this means something like this:
<tt> ssh-keygen -C "anathema.device@crowley"</tt>
(if your name is Anathema Device and your new machine is "crowley"). Just click through the questions it asks accepting the defaults. It will tell you what the key files are called and where it has put them.
<li>
If you accepted the defaults, the public key will be called <spanstyle="font-family:monospace; size=x-small; background-color: lightgray">id_rsa.pub</span> and it will be in <spanstyle="font-family:monospace; size=x-small; background-color: lightgray">~/.ssh/</span> - check that this is the case.
<li>Now copy the public key file to your <em>first machine</em>, the one that is already set up with a working key-pair setup with the expo server. Using email to yourself is easiest.
<li>Now upload the public key using sFTP (Filezilla configured to use sFTP, which uses Pageant by default) to <spanstyle="font-family:monospace; size=x-small; background-color: lightgray">expo.survex.com/home/expo/.ssh/keys/</span>
This adds your key on to the end of the authorized keys list and prints the last line - which should be your key that you just added.
<li>Now your public key is installed for your second machine. You check that it works by logging into the expo server using ssh from your second machine: <em>ssh expo@expo.survex.com </em>.
<p>Note that by using sFTP like this we avoid having to use a text editor over ssh. If you know what you are doing you can do this of course, but the above process is less likely to cause problems for a Windows user setting up their phone as a second device where they are not experienced with vi or nano.
