CUCC Expedition Handbook

Cryptographic Key Exchange

As of the server move in spring 2019 you need authorisation on the expo server to log in. This takes the form of an ssh key. You generate it on the machine you use for access, then send the public half to the server.

'ssh' is 'secure shell' and is widely used for secure access to machines and services.

What do I need to do?

You will need to run ssh-keygen/PuTTYgen on your device, email the public key to someone who already has ssh access (Wookey, Paul Fox, Philip Sargent, Sam Wenham). Once installed by them you should be able to log in as 'expo' over ssh (and other software like tortoise will also use this behind the scenes). This only needs doing once (for any machine you want access from).

Explanation of how ssh keys work.

A public key file looks like this: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApc9+PAMrDtWa8D8/ZneLP2X9UOYmTITAhTd2DRs8SE+NDgis5pYo/Xhtbrg86ePMAC2YM5xAkYx3jNA/VZ/PkB3gTzYJW3T/zTH+cc7YeWhy9l1zIMaYqeyvw7FxeSBaR4XoLPVtVUlai8DUDiWAEm7VvOKj1n68z1LxVh1MZXLm7btckf6fske2YU9UpjqT++AURQvFheRJ4la7KBJ7LXZ3A/TQ7HQaTpqmcQKCiRj/yZ5FNHxBk0M+ShbHUtz1GhXRCMJ3LZHaw24OJyVJ8YNzBiStBb1qcWCXX7HR9CUNhz7tA5HZyc1lau/1vwk8MSe93lyyLntzJKkqmkW/cQ== wookey@khi.e. a long string of characters with 'ssh-rsa' at the start and a 'user'@'machine' ID at the end.

Windows

On a Windows machine use puttygen, which is part of PuTTY. You need to install that if you don't already have it.

Follow the Puttygen instructions, but the really short version is:

  • Run PuTTYgen
  • Click on 'Generate'. Follow the instructions. Don't bother adding a passphrase.
  • Save the key
  • Copy all of the public key out of the window and paste that into the email. Make sure not to miss part or add newlines or otherwise mess with it.

    • Linux

    1. You need openssh-client installed - it's it extremely likely to already be installed. If not (as root/with sudo) apt install openssh-client.
    2. You may already have a key on this machine. If you already have ~/.ssh/id_rsa.pub, then send that.
    3. If not, run ssh-keygen. It may ask about passwords: you can add a password for extra security, but a passwordless key is fine, and more convenient.
    4. That will create a file: .ssh/id_rsa.pub in your home directory. Email that file to one of the admins listed above.