SSH access to cvs.gentoo.org

1.  SSH keys

Key Handling

Your SSH keypair authenticates you to Gentoo Infrastructure. Properly handling these keys is vital to keeping our machines safe. Please try to follow these guidelines:

• Place your private keys only on machines you trust. This means only you have root on these machines and they are not shared with other users.
• Do not trust Gentoo Infrastructure. Do not place copies of your keys on Gentoo machines (like dev.gentoo.org.) You may forward your SSH agent through Gentoo managed machines if they are configured to allow users to agent forward (more on forwarding later.)
• Encrypt your keys with a strong passphrase. If you have trouble making a passphrase try emerge pwgen; pwgen -sB 25
• Do not access Gentoo infrastructure from untrusted machines such as business kiosks at hotels, internet cafes, or machines at computer conferences. Many of these machines are infected with malware.
• If you believe your keys were compromised, contact infrastructure immediately. You can do this via #gentoo-infra on irc.freenode.net or by emailing incidents@gentoo.org.
• Official hostkey fingerprints for Gentoo Infrastructure servers are available on the server specifications page.

Creating the SSH keys

First of all, be physically logged on to your own computer. Make sure that no-one will see you typing stuff in, since we are going to type in passphrases and such. So get your pepperspray and fight all untrusted entities until you are home alone.

Now we are going to create our ssh keys, RSA keys to be exact. The key should be at least 2048 bits in length, but 4096 bits is recommended. Log onto your computer as the user that you are going to be using when you want to access cvs.gentoo.org. Then issue ssh-keygen -t rsa -b 4096:

$ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/home/temp/.ssh/id_rsa): (Press enter)
Created directory '/home/temp/.ssh'.
Enter passphrase (empty for no passphrase): (Enter your passphrase)
Enter same passphrase again: (Enter your passphrase again)
Your identification has been saved in /home/temp/.ssh/id_rsa.
Your public key has been saved in /home/temp/.ssh/id_rsa.pub.
The key fingerprint is:
85:35:81:a0:87:56:78:a2:da:53:6c:63:32:d1:34:48 user@examplehost This is the fingerprint of your new key

# ls ~/.ssh
id_rsa  id_rsa.pub

You may have more files than this, but the two files listed above are the ones that are really important.

The first file, id_rsa, is your private key. Don't give this to anyone; never decrypt it on an untrusted machine. Gentoo Staff will never ask you for a copy of your private key.

The second file, id_rsa.pub, is your public key. Distribute this file amongst all hosts that you want to be able to access through SSH pubkey authentification. This file should be appended to ~/.ssh/authorized_keys on those remote hosts. Also add it to your local host so you can connect to that one too if you have several boxes.

$ cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

Installing your public key on a machine using LDAP authentication for SSH

You should place your public key into LDAP, using perl_ldap, or ldapmodify directly. The Infrastructure LDAP guide describes this in more detail.

$ perl_ldap -b user -C sshPublicKey "$(cat ~/.ssh/id_rsa.pub)" <username>

Using keychain

Every time you want to log on to a remote host using SSH public key authentification, you will be asked to enter your passphrase. As much as everybody likes typing, too much is sometimes too much. Luckily, there is keychain to the rescue. There is an document on this one here, but I'll give you a quick introduction.

First, install keychain:

# emerge keychain

Now have keychain load up your private ssh key when you log on to your local box. To do so, add the following to ~/.bash_profile. Again, this should be done on your local machine where you work at the Gentoo CVS.

keychain ~/.ssh/id_rsa
. .keychain/hostname-sh

Be sure to substitute hostname with your hostname.