1

I need some basics about SSH, to help me understand the process of SSH connecting.

I have Ubuntu server on my virtualbox and Ubuntu desktop on my host. I've established connection with my VM by adding id_rsa.pub to authorized_keys on the remote (added by ssh-copy-id). id_rsa.pub is generated by ssh-keygen as well as id_rsa.

I successfully connect to my remote without typing the password, but I don't understand when exactly and why need the file id_rsa which is stored along to id_rsa.pub?

I tried to delete this private key, but in spite of this the connection still works! In my mind, this file doesn't need to establish connection with my VM.

  • 1
    Try do do a connection with ssh -v ... (verbose). It will print the exact process step to step. – Rmano Jan 15 '14 at 16:22
  • Great! Great! Very close to my expectations.. One moment was confused me: Offering RSA public key: /home/timur/.ssh/id_rsa Why not my client offering id_rsa.pub instead of id_rsa(private key)? Please, convert this comment to answer for my question. I want to accept it – Timur Fayzrakhmanov Jan 15 '14 at 16:37
3

To "explore" how ssh is working, you can use the verbose flags. For example,

ssh -v ...

will give information on the handshake. You can use multiple v, with a maximum of three, to have even more debugging info:

ssh -vvv ...

Nevertheless, the link of the wikipedia page posted by @darent is worth reading to understand the asymmetric key encryption. A lot of useful links on the details can be found in this question on SuperUser.

3

Let me try to explain this with an example. Suppose I trust you and want you to SSH into my computer and do something. I can tell you my password or you can give me your public key.

If you give me your public key, when you try to log into my computer, your SSH client will use your private key to generate the encrypted authentication request at your end and send it to my computer. My computer will use your public key to decrypt the encrypted authentication request and thus authenticate that it is you and not someone else trying to break into my computer.

Note: The private-public key pair is not used to encrypt the transmission between two computers. So once the connection is established the keys are not needed until the connection is terminated and a new connection is attempted. SSH has its own internal data encryption system in place that does not depend on the private-public key pair.

So, by accepting your public key, I have trusted you to enter my computer. If you ever break my trust I will delete your public key from my computer. Then you will not be able to SSH into my computer any more.

If you give your private key to someone else (or if someone steals it) then that person will be able to pretend to be you. If I find out that you have given your private key to someone else, I will delete your public key from my computer. Then neither you nor the other person will be able to SSH into my computer.

The public key you gave me is useless if I try to SSH into your computer, as it only good for decrypting information you generate with your private key. If you want me to SSH into your computer, you will have to put my public key in the right place in your computer.

Ubuntu stores your private keys in password management software called Password and Encryption Keys:

enter image description here

Note, the middle tab My Personal Keys. This to protect your private key from being stolen (and from accidentally deleting your private key).

Here is more information about the Seahorse password manager.

Hope this helps

  • Thank you! Theory I understand, but no one can't explain me why ssh connection still successfully exists when I even delete private key from my client ( – Timur Fayzrakhmanov Jan 15 '14 at 17:57
  • Hm! Big thanks, this is really helpful answer! Interesting...Does Ubuntu server have the same password management software or doesn't? – Timur Fayzrakhmanov Jan 15 '14 at 18:25
  • I am not sure about the server. Since the server doesn't have any GUI by default, I doubt it. – user68186 Jan 15 '14 at 18:30
  • 1
    Moreover, the keys are used for authentication, not for encrypting the connection channel. If you delete all your keys you will not be able to authenticate again, but existing connections will still work. – Rmano Jan 15 '14 at 19:00
  • 1
    Good point @Rmano. I will edit my answer. – user68186 Jan 15 '14 at 19:02
1

You are not supposed to manually "use" your private key. The public/private cryptography is based in using two keys, one that goes public and another that stays in your computer, the private one.

Whenever somebody has to send you an encrypted message, or you have to use authentication, like SSH does, it will use the public key to encrypt the data. Once you get the data, the only key that can decrypt them is the private one.

Think of it as if you had two keys: Whatever is locked with one key, can only be unlocked with the opposite. So don't delete your private key because that would render the public one useless.

If you want to learn more you can check this link to Wikipedia, it has a good explanation about asymmetric key encryption.

  • thank you for the answer, but can I break connection to remote by deleting my private key? – Timur Fayzrakhmanov Jan 15 '14 at 15:44
  • I want more concrete answer with exactly paths and files that are used to create SSH connection. – Timur Fayzrakhmanov Jan 15 '14 at 15:49
0

Do you mean you deleted the private key on the server? If that's the case it's only used when sshing FROM that server. It would have no impact on sshing TO that server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.