keycrypt is a wrapper for generating SSH Keys and then encrypting them with OpenSSL. keycrypt offers other features like copying the pubkey from your local machine to a remote host. This can even be done as part of the create step!
Windows git SSH authentication to GitHub. Follow @vladmihalcea. Imagine having a tool that can automatically detect if you are using JPA and Hibernate properly. Generating SSH keys. If you don’t have a SSH public/private key pair you can generate it using the puttygen utility.
Current Features
- SSH Key Creation
- SSH Key Encryption with OpenSSL
- Copying PubKey to Remote Server (similar to ssh-copy-id)
Future Features
- Improved PubKey Copying
- Scanning for unencrypted keys and prompting for encryption
Why would I need this?
The default encryption that ships with SSH isn't the most secure, it comprises of the following:
The header tells us the encryption algorithm that was used: AES-128 in CBC mode. The 128-bit hex string in the DEK-Info header is the initialization vector (IV) for the cipher. This is pretty standard stuff; all common crypto libraries can handle it.
Martin Kleppmann has show below that there are two primary weaknesses in the way SSH encrypts it's keys:
- The digest algorithm is hard-coded to be MD5, which means that without changing the format, it’s not possible to upgrade to another hash function (e.g. SHA-1). This could be a problem if MD5 turns out not to be good enough.
- The hash function is only applied once — there is no stretching. This is a problem because MD5 and AES are both fast to compute, and thus a short passphrase is quite easy to break with brute force.
From this it was devised that we could get a higher level of security from using OpenSSL. As such I wanted to automate the process of creating an SSH key and then encrypting it with OpenSSL, and keycrypt was born.
Credits
This idea was fostered from an article written by Martin Kleppmann
Today’s post is for developers. If you use the Git version control system with a service such as GitHub, GitLab or Bitbucket to host and manage your projects source codes, you know that by default Git connects to remotes using the HTTPS protocol, which requires you to enter username and password every time you run a command such as
git pull
or git push
.Using the SSH protocol, you can connect and authenticate to servers to use their services. The three mentioned services allow Git to connect via SSH instead of HTTPS. Connecting with public key encryption dispenses typing username and password for every Git command.
You are going to see in this post how to use GitHub, GitLab and Bitbucket with SSH.
Make sure an SSH client in installed
In order to connect using the SSH protocol, an SSH client must be installed on your system. If you use openSUSE, it should be already installed by default.
Just to make sure, open the terminal and run:
That command should output the version number of the SSH client being used:
In case the system informs that the ssh command was not found, you can install the OpenSSH client running:
Check for existing SSH keys
To connect using the SSH protocol, you need an SSH key pair (one private and the other public). If you have never used SSH, you can safely skip this topic and move on to the next. If you have ever used SSH (for instance, to remotely access a server), probably you already have an SSH key pair, in which case you don’t need to generate a new key pair.
To see if existing SSH keys are present, run:
That command should list the contents of the
~/.ssh
folder, in which the SSH client stores its configuration files:If you receive an error that there is no
~/.ssh
directory or there are no files in it, don’t worry: it means you haven’t created an SSH key pair yet. If that is the case, proceed to the next topic.By default, public SSH keys are named:
- id_dsa.pub;
- id_ecdsa.pub;
- id_ed25519.pub; or
- id_rsa.pub.
Inside my
~/.ssh
folder, I have an SSH key pair (id_rsa.pub
is the public key and id_rsa
is the private key) created a year ago (Jul 18 2018
).For security reasons, it is recommended that you generate a new SSH key pair at least once a year. If you already have an SSH key pair that was created more than a year ago, it is recommended that you proceed to the next topic.
If you already have an SSH key pair and want to reuse it, you can skip the next topic.
Generate a new SSH key pair
To generate a new SSH key pair, run the following command (replace
[email protected]
with your email address):Github Desktop Generate Ssh Key Linux
It asks you where to save the private key (
id_rsa
).Press Enter to accept the default location.
If you already have a private key, it asks whether it should overwrite:
If that happens, type
y
and press Enter.Then, enter and re-enter a passphrase (think of it as a kind of password):
The SSH key pair is created in
~/.ssh
.The whole interaction should look similar to the following:
Add the private SSH key to the ssh-agent
If you don’t want to type your passphrase each time you use your SSH keys, you need to add it to the ssh-agent, which is a program that runs in background while you are logged in to the system and stores your keys in memory.
To start the ssh-agent in background, run the following:
That command outputs the ssh-agentprocess identifier:
Then, add your SSH private key to the ssh-agent:
Type your passphrase and press Enter:
The command confirms that the private SSH key has been added to the ssh-agent:
Add the public SSH key to your account
Once you have an SSH key and have added it to the ssh-agent, you can set up connecting via SSH. Let’s see how to do that for each of the three servers: GitHub, GitLab and Bitbucket.
In all the three cases, the process is similar. Start by copying your public SSH key (
~/.ssh/id_rsa.pub
) file contents to the clipboard using the xclip command:xclip is a command line utility that allows access to the graphical interface clipboard from the terminal. If it is not installed, you can install it running:
GitHub
Using a browser, go to the GitHub home page at github.com and sign in to your account.
In the upper-right corner of the page, click your profile photo, then click Settings:
In the user settings sidebar, click SSH and GPG keys. Then click New SSH key.
Fill in the Title field with a descriptive label for the new key (for example, the name of your computer) and paste your public key into the Key field. Finally, click Add SSH key:
Now the key appears in the list of SSH keys associated with your account:
GitLab
Using a browser, go to the GitLab home page at gitlab.com and sign in to your account.
In the upper-right corner of the page, click your profile photo, then click Settings:
In the User Settings sidebar, click SSH Keys.
Paste your public key in the Key field. Fill in the Title field with a descriptive label for the new key (for example, the name of your computer). Finally, click Add key:
Now the key appears in the list of SSH keys associated with your account:
Bitbucket
Using a browser, go to the Bitbucket home page at bitbucket.org and log in to your account.
In the lower-left corner of the page, click your profile photo, then click Bitbucket settings:
In the Settings sidebar, in the Security section, click SSH keys. Then, click Add key.
Generate Ssh Key Aix
Fill in the Label field with a descriptive label for the new key (for example, the name of your computer) and paste your public key into the Key field. Finally, click Add key:
Now the key appears in the list of SSH keys associated with your account:
Test connecting via SSH
GitHub, GitLab and Bitbucket allow you to test whether SSH connection has been set up correctly before actually using it with Git.
GitHub
After you’ve added your SSH key to your GitHub account, open the terminal and run:
That command attempts an SSH remote access to GitHub.
If that is the first time you connect to GitHub via SSH, the SSH client asks you if it can trust the public key of the GitHub server:
Type
yes
and press Enter. The SSH client adds GitHub to the list of trusted hosts:Once added to the list of known hosts, you won’t be asked about GitHub’s public key again.
As this remote access via SSH is provided by GitHub just for testing, not for actual use, the server informs that you have successfully authenticated and terminates the connection:
If you completed the test successfully, now you can use SSH with GitHub.
The whole interaction should look similar to the following:
GitLab
If you have added your SSH key to your GitLab account, the test is very similar:
If you completed the test successfully, now you can use SSH with GitLab.
Bitbucket
If you have added your SSH key to your Bitbucket account, the test is very similar:
If you completed the test successfully, now you can use SSH with Bitbucket.
Clone a repository using SSH
Now that we’ve got our SSH keys set up, let’s see how to clone a Git repository using SSH instead of HTTPS.
GitHub
At GitHub, go to a project’s repository, click Clone or download and copy the URL to clone the repository using SSH:
The URL of a GitHub repository looks like:
Open the terminal and run the
git clone
command passing the copied URL as argument.Tip: to paste into the terminal, use Ctrl + Shift + V.
Note that now Git clones the repository without asking for a password:
GitLab
At GitLab, go to a project’s repository, click Clone and copy the URL to clone the repository using SSH:
The URL of a GitLab repository looks like:
Open the terminal and run the
git clone
command passing the copied URL as argument:Note that now Git clones the repository without asking for a password.
Bitbucket
At Bitbucket, go to a project’s repository, click Clone and copy the command to clone the repository using SSH:
Note that, differently from GitHub and GitLab that present the URL, Bitbucket presents the entire
git clone
command, including the URL.The URL of a Bitbucket repository looks like:
Open the terminal, paste and run the command you copied from Bitbucket:
Note that now Git clones the repository without asking for a password.
Reconfigure existing repositories to use SSH
The repositories we clone from now on using SSH will continue to use SSH for future Git commands such as
git pull
and git push
. But existing local repositories, previously cloned with HTTPS, will continue to use HTTPS, unless we set them up to use SSH.To do that, open the terminal and change the current directory to a local repository.
List the existing remote repositories and their URLs with:
That command should output something like:
Change your remote repository’s URL with:
Run
git remote -v
once more to verify that the remote repository’s URL has changed:Great. That done, Git will use SSH, instead of HTTPS, to synchronize that local repository with its remote equivalent.
References
I hope those tips can be useful to you as they have been to me since I started using Git. If you have any questions or trouble, don’t hesitate to comment! See you!
And always remember: have a lot of fun…