SSH Keys and Keychain

Creating SSH Keys

Simply open Terminal and type ssh-keygen -t dsa. At the Enter file in which to save the key prompt just hit enter. At the passphrase prompt type a unique passphrase, not one of the passwords you would ordinarily use. In total, it will look something like this:

Generating public/private dsa key pair.
Enter file in which to save the key (/Users/drbrain/.ssh/id_dsa):         
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /Users/drbrain/.ssh/id_dsa.
Your public key has been saved in /Users/drbrain/.ssh/id_dsa.pub.
The key fingerprint is:
b2:1d:6c:2c:b2:26:ff:70:00:8e:9b:19:b8:44:e3:a2
drbrain@kaa.coop.robotcoop.com

Using SSHKeychain

First, you'll need to download SSHKeychain from www.sshkeychain.org install it and start it. (That should be it.)

You can configure SSHKeychain to remove your SSH keys from the agent when your machine goes to sleep or the screen saver comes on. SSHKeychain will use Keychain to remember your SSH key password for you.

Installing SSH Keys on Remote Hosts

Now we just need to copy the keys to remote machines. First, make sure the remote host has a ~/.ssh. If the remote host doesn't have a ~/.ssh, create one:

ssh remote_host
mkdir ~/.ssh
chmod 700 ~/.ssh

And next, copy your SSH public key (ends in '.pub') from the local host to the remote host. Never copy the private key to a remote machine (the id_dsa file).

I always make the remote hosts' copy of the public key be named "localuser@localhostname.pub" so I don't accidentally overwrite a public key for another system. On my laptop "kaa" I'm "drbrain", so "drbrain@kaa.pub":

scp ~/.ssh/id_dsa.pub remote_host:.ssh/drbrain@kaa.pub

Then add the key to the list of authorized keys, which will let you log in without typing the password for your account on the remote machine. Always be sure to append the key, you don't want to overwrite any other keys you've configured there.

ssh remote_host
touch ~/.ssh/authorized_keys
cat ~/.ssh/drbrain@kaa.pub >> ~/.ssh/authorized_keys

Now you should be able to log in without typing your password on the remote host!