To access the server that hosts the mediazone website, you need an SSH Key pair. SSH Uses so called Public Key Authentication, which is inherently far more secure than simple password-based authentication. Similar to security systems employed by many banks, it relies on two things: something you know and something you have. This is a bit like an ATM card: you need both the PIN number and the card to access your money. the PIN is something you (and only you) know, and the card is something you (and only you) have.
If an attacker knows your PIN, he still needs to get hold of your card, and vice versa.
SSH access using PKI (Public Key Infrastructure) works in the same way: You generate a so-called key pair. This pair consists of a public key and a private key. You should be very careful with the private key and never give it to someone else, send it in an email, or (potentially) share or expose it in any other way. It should be on your computer and nowhere else.
The public key on the other hand is not secret. You could post it on your website if you wanted to. The way SSH works with this key pair is as follows: The public key is stored on the server (by the server admin) you want to access, and SSH only lets you access it if it sees you have the corresponding private key. A further brilliant scheme implemented by SSH is that the validity of your private key can be established without sending it over “the wire” – there is no way for someone to intercept your private key because it’s never ever sent over the internet.
In addition to this key pair (the “something you have”), you protect your private key with a password (the “something you know”).
If you need to access the mediazone server using ssh, you must do the following on the computer you wish to access the server from (assuming this is a Mac OS X machine):
1. Open the Terminal application
2. in the window that appears, type the following:
mkdir .ssh
If you get mkdir: .ssh: File exists, don’t worry. Also set the permissions for ssh if the directory didn’t exist yet:
chmod 700 .ssh
3. To generate the actual keys, type the following:
ssh-keygen -b 2048
The system asks you a number of questions:
- Enter file in which to save the key (/Users/gert/.ssh/id_rsa): – press return
- Enter passphrase (empty for no passphrase): – Enter the password you would like to use for this key pair; ALWAYS enter a passphrase here, using empty passwords is extremely insecure and should only be used in very specific circumstances (such as sysadmins running automated processes in a carefully hardened environment). System administrators trust you to do the right thing here and supply a decent password.
- Enter same passphrase again: – enter the password again for verification and to catch spelling mistakes
4. That’s it, your private key is now generated and stored in $HOME/.ssh/id_rsa and your public key in $HOME/.ssh/id_rsa.pub
5. You need to give your public key to the system administrator (which is Gert if you want to access the media zone server). You can put this file on a USB stick and give it to him, or email the file as an attachment.
To find the file so you can copy it (never move it, ssh relies on that file being there), open a Finder window and go to your home directory. Then use Go -> Go to Folder… and type “.ssh” in the dialog that appears. You should now see a (greyed out) .ssh folder with two files: id_rsa and id_rsa.pub. ONLY copy the id_rsa.pub file to a usb stick or attach it in an email to gert.
When your user account on the server is set up and your public ssh key is put in place, the sysadmin (yes, gert) will let you know and you should be able to access the server from then on.
NOTES:
- You still need to go through the VPN if you want to access this from outside VUW
- If you want to access the server from your Mac at work, you need to follow the same process as outlined above on that machine.
- We don’t support ssh clients on Windows machines, but if you have a Windows machine with an ssh client (Putty seems to be popular), there is a lot of documentation about generating keys for this setup. The underlying protocols are the same, so a public key generated with Putty will work just as well.
