What Is an Identity?

An SSH identity is a sequence of bits that says, “I am really me.” It is a mathematical construct that permits an SSH client to prove itself to an SSH server, so the SSH server says, “Ah, I see, it’s really you. You are hereby authenticated. Come in.”

Figure 6-1. SSH user key and agent configuration (highlighted parts)

An identity consists of two parts, called the private key and the public key. Together, they are known as a key pair.

The private key represents your identity for outgoing SSH connections. When you run an SSH client in your account, such as ssh or scp, and it requests a connection with an SSH server, the client uses this private key to prove your identity to the server.

Warning

Private keys must be kept secret. An intruder with your private key can access your account as easily as you can.

The public key represents your identity for incoming connections to your account. When an SSH client requests access to your account, using a private key as proof of identity, the SSH server examines the corresponding public key. If the keys “match” (according to a cryptographic test), authentication succeeds and the connection proceeds. Public keys don’t need to be secret; they can’t be used to break into an account.

A key pair is typically stored in a pair of files with related names. In SSH, the public-key filename is the same as the private one, but with the suffix .pub added. For example, if the file mykey holds a private key, its corresponding public key is found in mykey.pub.

You may have as many SSH identities as you like. Most SSH implementations let you specify a default identity clients use unless told otherwise. To use an alternative identity, you must change a setting by command-line argument, configuration file, or some other configuration tool.

The structure of identity files differs for OpenSSH and Tectia, so we explain them separately. Their locations in the filesystem are shown in Figures 6-2 (private keys) and 6-3 (public keys).

Figure 6-2. SSH identity files (private keys) and the programs that use them

6.1.1 OpenSSH Identities

An OpenSSH identity is stored in two files. By default, the private key is stored in the file id_dsa, and the public key in id_dsa.pub.^[91] This key pair, which is kept in your ~/.ssh directory, is your default identity that clients use unless told otherwise. The private key looks something like this:

    -----BEGIN DSA PRIVATE KEY-----         Or "BEGIN RSA" for RSA keys
    Proc-Type: 4,ENCRYPTED
    DEK-Info: DES-EDE3-CBC,89C3AE51BC5876FD

    MXZJgnkYE+1+eff3yt9j/aCCABz75egbGJfAbWrseiu0k3Dim9Teu2Ob1Xjdv4U9
    II1hVYOkgQYuhdJbzrLMpJ0W1+N5ujI8akJ6j0ESeGTwJbhGyst71Y3A2+w4m1iv
    ... lines omitted ...
    gMtQSdL26V1+EmGiPfio8Q==
    -----END DSA PRIVATE KEY-----

Figure 6-3. SSH authorization files (public keys) and the programs that use them

and the public key file contains a long, single line:

    ssh-dss AAAAB3NzaC1kc3MAAACBAM4a2KKBE6zhPBgR ...more... smith@example.com

The file format for these keys is known as “OpenSSH format.”

The .pub file containing your public key has no function by itself. Before it can be used for authentication, this public key must be copied into an authorization file on an SSH server machine, ~/.ssh/authorized_keys. Thereafter, when an SSH client requests a connection to your server account using a private key as proof of identity, the OpenSSH server consults your authorized_keys file to find the matching public key.

6.1.2 Tectia Identities

A Tectia key pair is also stored in two files with related names (i.e., the private-key filename plus .pub yields the public-key filename). Tectia key files are often named based on the key’s cryptographic properties. For example, a 2048-bit, DSA-encrypted key is generated by default in the Tectia files id_dsa_2048_a and id_dsa_2048_a.pub. These files are in a format known as “SECSH public-key file format” and sometimes “SSH2 format.” The encrypted private key looks like this:

    ---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----
    Subject: smith
    Comment: "2048-bit dsa, smith@example.com, Sat Feb 12 2005 15:17:53 -0200"

Converting SSH-1 Keys to SSH-2 with ssh-keyconverter

OpenSSH includes the program ssh-keyconverter, which converts old SSH-1 RSA keys into a format suitable for SSH-2 authentication. If you used SSH-1 in the early days but are just getting around to upgrading, ssh-keyconverter might save you the time of generating and installing new keys. There are two uses:

Converting key files

Run ssh-keyconverter with the -k option to convert a single SSH-1 RSA key file to SSH-2 format. If your private key file is mykey, run:

    $ ssh-keyconverter -k -o newfile mykey
    Creates newfile and newfile.pub

Converting your entire authorized_keys file

Run ssh-keyconverter with the -a option to convert all SSH-1 RSA keys in your authorized_keys file to SSH-2 format:

    $ cd ~/.ssh
    $ ssh-keyconverter -a -o newfile authorized_keys
    ...Check that file newfile looks correct, and then...
    $ mv newfile authorized_keys
    $ chmod 600 authorized_keys

Existing SSH-2 format keys are ignored.

See the manpage for ssh-keyconverter for more details.

    P2/56wAAA4oAAAAmZGwtbW9kcHtzaWdue2RzYS1uaXN5LXNoYTF9LGRoe3BsYWlufX0AAA
    AIM2Rlcy1jYmMAAANIEYkNTUySnPZlYsNh15lkVfzRk6dPx4XYcXe+4f45XHIxwqcUo2Cd
    ... lines omitted ...
    RFI0RQxDhgWS/SXlFF
    ---- END SSH2 ENCRYPTED PRIVATE KEY ----

and the public key like this:

    ---- BEGIN SSH2 PUBLIC KEY ----
    Subject: smith
    AAAAB3NzaC1kc3MAAAEBAP3QfkjOBm1+aPgEUG39j5va13CRrPSedFYtv/52VqIgrBzRV8
    Es1KHPIwmB1FOn5ej02FATNGtaR/fg6K4DVoWscIHGZk95OjLgAz+JeBq7lxYwQ0EzpsTQ
    ... lines omitted ...
    mQ1et1r4Wr0fj0F/2tXf+o71P2HfNw1M6I0B/54eI=
    ---- END SSH2 PUBLIC KEY ----

Unlike OpenSSH, however, a Tectia identity is not a single key but a collection of keys. When a Tectia client tries to authenticate, it may use all keys in the collection. If the first key fails to authenticate, the Tectia client automatically tries the second, and so forth, until it succeeds or fails completely.

To create an identity in Tectia, private keys must be listed in a file called an identification file. Your default identity file is ~/.ssh2/identification. ^[92] Inside the file, private keys are listed one per line. For public-key authentication, a line begins with the keyword IdKey, followed by the name of the private-key file:

    # Tectia identification file
    # The following names are relative to ~/.ssh2
    IdKey id_dsa_2048_a
    IdKey my-other-tectia-key
    # This key uses an absolute path
    IdKey /usr/local/etc/third-key

The identification file may also contain PGP-related keywords: [6.5]

    # Tectia identification file
    PgpSecretKeyFile my-file.pgp
    IdPgpKeyName my-key-name

Like OpenSSH, Tectia has an authorization file for incoming connections, but with a difference. Instead of containing copies of the public keys, the Tectia authorization file merely lists the public-key filenames using the Key keyword:

    # Tectia authorization file
    Key id_dsa_2048_a.pub
    Key something-else.pub

Notice you have only one copy of each public key. This is slightly easier to maintain than OpenSSH’s system, which has separate copies in the .pub file and authorized_keys file. [8.2.1]

Tip

Tectia’s identification file can group multiple keys as a single identity. You can approximate this behavior in OpenSSH with the IdentityFile keyword. [7.4.2] To set up a default “identity” with multiple keys, add the following section to the end of your ~/.ssh/config file:

    Host *
     IdentityFile key1
     IdentityFile key2
     IdentityFile key3

Now this multiple-key “identity” is available for all SSH connections. Similarly, you can place multiple IdentityFile values in any other section of the configuration file to associate a multikey identity with a particular host or set of hosts.

^[91]If your default key is an RSA key, the filenames are id_rsa and id_rsa.pub

^[92]This default may be changed with the IdentityFile keyword. [7.4.2]

Previous Chapter

6. Key Management and Agents

Next Chapter

Creating an Identity

Table of Contents for SSH, The Secure Shell: The Definitive Guide, 2nd Edition

What Is an Identity?

Warning

6.1.1 OpenSSH Identities

6.1.2 Tectia Identities

Tip

Table of Contents for
SSH, The Secure Shell: The Definitive Guide, 2nd Edition