My first attempt since ssh-keygen doesn't support dsa with size of 2048 (DSA keys must be 1024 bits), was to generate one with the size of 1024 (with no password):
$ ssh-keygen -b 1024 -t dsa
id_dsa
id_dsa.pub
then used the command ssh-copy-id
to add the key to my authorized_keys
.
ssh-copy-id -i ~/.ssh/id_dsa.pub user@host
at the end as suggested tried the ssh user@host
with success without being request any password.
https://www.ssh.com/academy/ssh/keygen
But since 1024
is not recommended and the minimal requested is 2048, tried searching using openssl
instead that does support the 2048
for dsa
format.
Found the following 'tutorial': https://www.howtouselinux.com/post/create-rsa-dsa-key-with-openssl how to generate the keys using openssl
$ openssl dsaparam -out dsaparam.pem 2048
$ openssl gendsa -out dsaprivkey.pem dsaparam.pem
with this two commands creates the private key in the file dsaprivkey.pem
to get the public key
$ openssl dsa -in dsaprivkey.pem -outform DER -pubout -out dsapubkey.der
Now my problem was how to integrate this key's into to my authorized_keys
the public and the private was already in /.ssh
folder that generated directly.
At this point not sure if this is the correct approach since to me openssl is used more in the context of generating certificates to install and permit the HTTPS communication and not much to do with authentication using the public and private keys as openssh...
but still tried using as example to convert the pem file into a public key using the command suggested
ssh-keygen -y -f dsaprivkey.pem > dsa_pubkey.pub
and with this public key dsa_pubkey.pub
could use with ssh-copy-id
, but still was in doubt if .pem file should be the private key as the one used or should it be public key instead but again read somewhere that dsaprivkey.pem should in fact contains both the keys
$ openssl dsa -in dsaprivkey.pem -outform DER -pubout -out dsapubkey.der
that makes some sense since the public key was generated using the private as input.
after the step ssh-copy-id
ssh-copy-id -f -i ~/.ssh/dsa_pubkey.pub user@host
but now the ssh user@host requests the password so it means its not working with this new dsa 2048 keys.
Can some give some light to what steps are wrong or if this is even possible?? since its seems to me to be redundant to use openssl
to generate the dsa 2048 keys just to later on convert using ssh-keygen
that doesn't support 2048 in the first place...
Thanks for the answers, gona follow as sugested here and use the rsa
that is already was what was inclined to use from the beginning...
As written by @dave_thompson_085, OpenSSH ssh and sshd do support all DSA sizes allowed by OpenSSL/libcrypto, but ssh-keygen can only generate ssh-dss keys with 1024 bits. So the reason why the 2048-bit ssh-dss key didn't work for you may be because it was disabled in the configuration of ssh or sshd. @dave_thompson_085 also wrote: OpenSSH 7.0 up by default disables ssh-dss for all sizes, and larger (186-3) sizes still use SHA-1 which is no longer considered secure.
So may may want to run ssh -vvv user@host
, and post the output to your question. It will reveal which key is used, which keys ssh offers and which keys sshd supports.
You may want to use ssh-ed25519 keys (always 128 bits, secure) or ssh-rsa2 keys (any number of bits, at least 3072 bits is recommended for good security) or ssh-rsa keys (with SHA-1) for OpenSSH sshd older than 8.8 (ssh-rsa disabled by default in OpenSSH 8.8) instead with OpenSSH. See also reasons why ssh-dss keys are insecure.