This howto demonstrates how to convert an OpenSSL key to a public/private OpenSSH key-pair.
The motivation for converting this is simple — dual use. That is to say, any user or application that has been issued a certificate can now use their SSL-based credentials for both SSL- and SSH-based authentication.
Requirements
You’ll need a valid certificate and private key — actually only the key is required. This recipe assumes that your certificate and key will have the names user-crt.pem and user-key.pem, respectively. If your key is encrypted (which it should be), you’ll also need to have it’s passphrase handy.
You’ll need a shell account on a system that supports OpenSSH logins using public/private key authentication.
Solution
The solution is to extract the public key from the private key using ssh-keygen, copy the new key-pair into place, and test them out.
1. Copy the private SSL key to ~/.ssh/id_ssl.
$ cp user-key.pem ~/.ssh/id_ssl
$ chmod 600 ~/.ssh/id_ssl
2. Extract the public SSH key using ssh-keygen.
$ ssh-keygen -y -f ~/.ssh/id_ssl > ~/.ssh/id_ssl.pub
$ chmod 600 ~/.ssh/id_ssl.pub
3. Add the public key to your authorized_keys
$ cat ~/.ssh/id_ssl.pub >> ~/.ssh/authorized_keys
4. Test the new key by attempting to SSH to localhost.
$ ssh -i ~/.ssh/id_ssl localhost
At this point, you’ll need to enter your passphrase (assuming you had one), and if all goes well, you’ll be sitting at a new shell prompt.
5. Remove the test key from your authorized_keys file.
In theory, a single certificate and key issued to an employee would be sufficient to access all participating SSL- and SSH-based resources in a given environment (or perhaps the entire company).
This post is based on an original recipe by Klayton Monroe.
VN:F [1.8.5_1061]
Rating: 0.0/10 (0 votes cast)
VN:F [1.8.5_1061]
Related posts:
No related posts.