Generate Private Ssh Key Windows

| 14-05-2021
[RAND-1-100] Comments

Generating a new SSH key. Open Terminal Terminal Git Bash. Paste the text below, substituting in your GitHub email address. $ ssh-keygen -t rsa -b 4096 -C ' youremail@example.com '. This creates a new ssh. When you're prompted to 'Enter a file in which to save the key,' press Enter. May 23, 2019 By default, the ssh-keygen command will create two files in the user's.ssh folder: idrsa and idrsa.pub. Idrsa (without an extension) is the private key file, while idrsa.pub contains the public key. With the key created, next you must start the SSH Agent service which manages private keys locally and coordinates their usage in authentication.

-->

Most authentication in Windows environments is done with a username-password pair.This works well for systems that share a common domain.When working across domains, such as between on-premise and cloud-hosted systems, it becomes more difficult.

By comparison, Linux environments commonly use public-key/private-key pairs to drive authentication.OpenSSH includes tools to help support this, specifically:

  • ssh-keygen for generating secure keys
  • ssh-agent and ssh-add for securely storing private keys
  • scp and sftp to securely copy public key files during initial use of a server

This document provides an overview of how to use these tools on Windows to begin using key authentication with SSH.If you are unfamiliar with SSH key management, we strongly recommend you review NIST document IR 7966 titled 'Security of Interactive and Automated Access Management Using Secure Shell (SSH).'

About key pairs

Key pairs refer to the public and private key files that are used by certain authentication protocols.

SSH public-key authentication uses asymmetric cryptographic algorithms to generate two key files – one 'private' and the other 'public'. The private key files are the equivalent of a password, and should protected under all circumstances. If someone acquires your private key, they can log in as you to any SSH server you have access to. The public key is what is placed on the SSH server, and may be shared without compromising the private key.

When using key authentication with an SSH server, the SSH server and client compare the public key for username provided against the private key. If the public key cannot be validated against the client-side private key, authentication fails.

Multi-factor authentication may be implemented with key pairs by requiring that a passphrase be supplied when the key pair is generated (see key generation below).During authentication the user is prompted for the passphrase, which is used along with the presence of the private key on the SSH client to authenticate the user.

Host key generation

Public keys have specific ACL requirements that, on Windows, equate to only allowing access to administrators and System.To make this easier,

  • The OpenSSHUtils PowerShell module has been created to set the key ACLs properly, and should be installed on the server
  • On first use of sshd, the key pair for the host will be automatically generated. If ssh-agent is running, the keys will be automatically added to the local store.

To make key authentication easy with an SSH server, run the following commands from an elevated PowerShell prompt:

Since there is no user associated with the sshd service, the host keys are stored under ProgramDatassh.

User key generation

To use key-based authentication, you first need to generate some public/private key pairs for your client.From PowerShell or cmd, use ssh-keygen to generate some key files.

This should display something like the following (where 'username' is replaced by your user name)

You can hit Enter to accept the default, or specify a path where you'd like your keys to be generated.At this point, you'll be prompted to use a passphrase to encrypt your private key files.The passphrase works with the key file to provide 2-factor authentication.For this example, we are leaving the passphrase empty.

Now you have a public/private ED25519 key pair(the .pub files are public keys and the rest are private keys):

Remember that private key files are the equivalent of a password should be protected the same way you protect your password.To help with that, use ssh-agent to securely store the private keys within a Windows security context, associated with your Windows login.To do that, start the ssh-agent service as Administrator and use ssh-add to store the private key.

After completing these steps, whenever a private key is needed for authentication from this client, ssh-agent will automatically retrieve the local private key and pass it to your SSH client.

Note

It is strongly recommended that you back up your private key to a secure location,then delete it from the local system, after adding it to ssh-agent.The private key cannot be retrieved from the agent.If you lose access to the private key, you would have to create a new key pairand update the public key on all systems you interact with.

Deploying the public key

To use the user key that was created above, the public key needs to be placed on the server into a text file called authorized_keys under usersusername.ssh.The OpenSSH tools include scp, which is a secure file-transfer utility, to help with this.

To move the contents of your public key (~.sshid_ed25519.pub) into a text file called authorized_keys in ~.ssh on your server/host.

This example uses the Repair-AuthorizedKeyPermissions function in the OpenSSHUtils module which was previously installed on the host in the instructions above.

These steps complete the configuration required to use key-based authentication with SSH on Windows.After this, the user can connect to the sshd host from any client that has the private key.

On Windows, you can create SSH keys in many ways. This document explains how to use two SSH applications, PuTTY and Git Bash.

Joyent recommends RSA keys because the node-manta CLI programs work with RSA keys both locally and with the ssh agent. DSA keys will work only if the private key is on the same system as the CLI, and not password-protected.

PuTTY

PuTTY is an SSH client for Windows. You can use PuTTY to generate SSH keys. PuTTY is a free open-source terminal emulator that functions much like the Terminal application in macOS in a Windows environment. This section shows you how to manually generate and upload an SSH key when working with PuTTY in the Windows environment.

About PuTTY

PuTTY is an SSH client for Windows that you will use to generate your SSH keys. You can download PuTTY from www.chiark.greenend.org.uk.

When you install the PuTTY client, you also install the PuTTYgen utility. PuTTYgen is what you will use to generate your SSH key for a Windows VM.

This page gives you basic information about using PuTTY and PuTTYgen to log in to your provisioned machine. For more information on PuTTY, see the PuTTY documentation

Generating an SSH key

To generate an SSH key with PuTTYgen, follow these steps:

  1. Open the PuTTYgen program.
  2. For Type of key to generate, select SSH-2 RSA.
  3. Click the Generate button.
  4. Move your mouse in the area below the progress bar. When the progress bar is full, PuTTYgen generates your key pair.
  5. Type a passphrase in the Key passphrase field. Type the same passphrase in the Confirm passphrase field. You can use a key without a passphrase, but this is not recommended.
  6. Click the Save private key button to save the private key. You must save the private key. You will need it to connect to your machine.
  7. Right-click in the text field labeled Public key for pasting into OpenSSH authorized_keys file and choose Select All.
  8. Right-click again in the same text field and choose Copy.

Importing your SSH key

Now you must import the copied SSH key to the portal.

Ssh
  1. After you copy the SSH key to the clipboard, return to your account page.
  2. Choose to Import Public Key and paste your SSH key into the Public Key field.
  3. In the Key Name field, provide a name for the key. Note: although providing a key name is optional, it is a best practice for ease of managing multiple SSH keys.
  4. Add the key. It will now appear in your table of keys under SSH.

PuTTY and OpenSSH use different formats of public SSH keys. If the text you pasted in the SSH Key starts with —— BEGIN SSH2 PUBLIC KEY, it is in the wrong format. Be sure to follow the instructions carefully. Your key should start with ssh-rsa AAAA….

Once you upload your SSH key to the portal, you can connect to your virtual machine from Windows through a PuTTY session.

Git Bash

The Git installation package comes with SSH. Using Git Bash, which is the Git command line tool, you can generate SSH key pairs. Git Bash has an SSH client that enables you to connect to and interact with Triton containers on Windows.

To install Git:

  1. (Download and initiate the Git installer](https://git-scm.com/download/win).
  2. When prompted, accept the default components by clicking Next.
  3. Choose the default text editor. If you have Notepad++ installed, select Notepad++ and click Next.
  4. Select to Use Git from the Windows Command Prompt and click Next.
  5. Select to Use OpenSSL library and click Next.
  6. Select to Checkout Windows-style, commit Unix-style line endings and click Next.
  7. Select to Use MinTTY (The default terminal of mYSYS2) and click Next.
  8. Accept the default extra option configuration by clicking Install.

When the installation completes, you may need to restart Windows.

Launching GitBash

To open Git Bash, we recommend launching the application from the Windows command prompt:

  1. In Windows, press Start+R to launch the Run dialog.
  2. Type C:Program FilesGitbinbash.exe and press Enter.

Generating SSH keys

First, create the SSH directory and then generate the SSH key pair.

One assumption is that the Windows profile you are using is set up with administrative privileges. Given this, you will be creating the SSH directory at the root of your profile, for example:

Ssh Generate Private Key

  1. At the Git Bash command line, change into your root directory and type.

  1. Change into the .ssh directory C:Usersjoetest.ssh

  2. To create the keys, type:
  1. When prompted for a password, type apassword to complete the process. When finished, the output looks similar to:

Uploading an SSH key

To upload the public SSH key to your Triton account:

  1. Open Triton Service portal, select Account to open the Account Summary page.
  2. From the SSH section, select Import Public Key.
  3. Enter a Key Name. Although naming a key is optional, labels are a best practice for managing multiple SSH keys.
  4. Add your public SSH key.

Ssh Key Github

Key

When Triton finishes the adding or uploading process, the public SSH key appears in the list of SSH keys.

What are my next steps?

Ssh Key Generation

  • Adding SSH keys to agent.
  • Set up the Triton CLI and CloudAPI on Windows.
  • Set up the Triton CLI and CloudAPI.
  • Create an instance in the Triton Service Portal.
  • Set up the triton-docker command line tool.
  • Visit PuTTYgen to learn more about the PuTTYgen and to seethe complete installation and usage guide.