Quelltext der Seite Dienste/SSH/en

<languages />
= SSH =

On many Linux/Unix computers at the FB3, you can log in via [https://en.wikipedia.org/wiki/Secure_Shell SSH]. This page provides instructions for using this service, as well as a list of host keys from known SSH servers in the faculty network.

The login via SSH is done exclusively via public key authentication.

<span id="FB3-Rechner_auf_denen_man_sich_mit_SSH_anmelden_kann"></span>
== FB3 computers that can be accessed via SSH ==

This is a non-exhaustive list of FB3 computers that can be accessed via SSH:

; login.informatik.uni-bremen.de
: Login server with Linux.
; login-smartos.informatik.uni-bremen.de
: Login server on a [https://en.wikipedia.org/wiki/SmartOS SmartOS] zone.
; login-freebsd.informatik.uni-bremen.de
: Login server with [https://www.freebsd.org/ FreeBSD].
; (x01-x10).informatik.uni-bremen.de
: Linux computers in the [[Special:MyLanguage/Praktikumspool|practicum area]].
; (m01-m06).informatik.uni-bremen.de
: macOS computers (Intel) in the Praktikumspool.
; (mm1-mm5).informatik.uni-bremen.de
: macOS-Rechner (ARM) in the Praktikumspool.

<span id="SSH-Hostschlüssel_von_FB3-Rechnern"></span>
== SSH host keys of FB3 computers ==

Current list of host keys for FB3 computers in OpenSSH format: [http://www.informatik.uni-bremen.de/t2/ssh/out/openssh/ssh_known_hosts ssh_known_hosts]
<span id="Zugriff_auf_Dateien_im_FB3-Netz"></span>
== Accessing files in the FB3 network ==

FB3 computers that can be accessed via SSH typically mount various NFS file shares from the network, which can be found under <code>/home</code>. Among others, this includes the [[Special:MyLanguage/Accounts/Heimverzeichnis|home directories]] and the [[Special:MyLanguage/Dienste/Homepages|personal websites]].

This allows remote access via [https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol SFTP] through SSH.

It should be noted that not all available directories under <code>/home</code> may always be listed. These will be automatically mounted when accessing the path.

For example, it may happen that <code>ls /home</code> does not show an entry for <code>wwwu</code>, but <code>cd /home/wwwu/$USER</code> still works (also, <code>wwwu</code> will be displayed in <code>/home</code> after accessing it once).

<span id="Einrichten_von_Public-Key-Authentifizierung"></span>
== Setting up public key authentication ==

<div class="mw-translate-fuzzy">
This guide applies to all operating systems that have an [https://www.openssh.com/ OpenSSH] client available, which includes among other Linux, macOS, and Windows.
</div>

OpenSSH is part of the operating system in current Windows versions but may need to be activated. See [[Special:MyLanguage/Dienste/SSH/Windows|here]] for a guide on how to do this.

For the login, a public and a private key are required. The public key is stored on the SSH server and can be published or shared with others without concern, while the private key is solely possessed by the client and should be kept secret under all circumstances.

{{Note|1=Common Windows clients, such as [https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html PuTTY] and [https://winscp.net/ WinSCP], can utilize the SSH agent included in current Windows versions for authentication, so no separate configuration or private keys in other formats are necessary. See [[Special:MyLanguage/Dienste/SSH/Windows|here]] for a guide on setting this up.}}

<span id="Erzeugen_eines_Schlüsselpaares"></span>
=== Generatiang a keypair ===

To generate a key pair, the following command can be executed on the client machine:

<pre>
ssh-keygen -t ed25519
</pre>

It generates the files <code>id_ed25519</code> (private key) and <code>/.ssh/id_ed25519.pub</code> (public key) in the directory <code>~/.ssh</code>. With the parameter <code>-f $FILENAME</code>, the file names and paths can be customized.

The command prompts for a so-called passphrase to be entered. This is used to encrypt the private key, so it can only be used in conjunction with the passphrase.

{{Warning|1=Skipping a passphrase poses a significant security risk. If the private key falls into the wrong hands, it can be easily used for authentication without any further action required.}}

<span id="Öffentliche_Schlüssel_auf_SSH-Servern_hinterlegen"></span>
=== Installing public keys on SSH servers ===

If you place a public key in your [[Special:MyLanguage/Accounts/Heimverzeichnis|home directory]], you can automatically log in to all FB3 computers that mount it (and allow login via SSH).

Using the example of the key pair generated above, you need to insert the contents of the file <code>id_ed25519.pub</code> ('''''NOT''''' <code>id_ed25519</code>) into the file <code>.ssh/authorized_keys</code>. If the <code>.ssh</code> directory does not exist, you can easily create it as follows:

<pre>
mkdir ~/.ssh
chmod 700 .ssh
</pre>

If you are not on-site to place your public key directly on a computer, you can instead use the [https://usertools.informatik.uni-bremen.de/pubkeys FB3 user tools]. The public keys stored there are not placed in the home directory but are saved in a database, so you may only be able to log in to certain computers (see the text on the linked page).

<span id="Verwenden_von_privaten_Schlüsseln"></span>
=== Using private keys ===

If you used the default path for the key files when generating the key pair, the SSH client will automatically detect and try to use the private key.

If you chose a different path or filename, you can specify the path to the private key as follows:

<pre>
ssh -i /pfad/zum/privaten/schlüssel zielhost
</pre>

Alternatively, you can use the configuration file <code>~/.ssh/config</code>. See the [https://man.openbsd.org/ssh_config OpenSSH documentation] for more information on this.