Monday, July 16, 2007

Using ssh keys with Filezilla

One of the best FTP client I used under windows is FileZilla. It is simple but works very well. You can download it <a href="http://filezilla.sourceforge.net/">here.</a>
It is great to connect to old FTP sites and can now be used to connect to site using FTP over ssh. It is pretty straight forward if you can login using user/password authentification but it is more tricky if you want to use public/private ssh keys.
The trick is that FileZilla uses modules from putty (the best free telnet/ssh client for windows) to authenticate using keys.

Here is the complete (I hope !) configuration of FileZilla and putty to use ssh keys.

1 ) download the components
Go to <a href="http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html">putty download page</a> and download either putty.zip (which contains everything needed) or download the following components :
- PuTTY : The telnet/ssh client itself
- PuTTYgen : The ssh key generator
- Pageant : The ssh agent to handle passphrase ( I will explain it later ).

2 ) Generating your keys
The first step is to create your public/private key pair that you will be using to access sites. We will only consider RSA ssh keys in this document. Open PuTTYgen.<BR>


<img width='' height='' border='0' hspace='5' align='left' src='http://moon.homeunix.com:8080/blog/uploads/putty01.jpg' alt='' /><BR>


Click on "Generate". You will have to move your mouse to generate random numbers. When it 's finished you will see the following screen :<BR>


<img width='' height='' border='0' hspace='5' align='left' src='http://moon.homeunix.com:8080/blog/uploads/putty02.jpg' alt='' /><BR>


You can modify the Key Comment with whatever you want. It is a good idea to put something like : MyWindowsXP key.... This description is for you, it is not parsed by the ssh system.
The next field is extremelly important : <b>Please, USE A PASSPHRASE</b>.
When everything is done, click on "Save public key". It is a good idea to name your file id_rsa.pub. Although this is not mandatory (you can give any name you want), this would respect the standard name for rsa key file.
Then click on save private key. You can name this file id_rsa.
A quick explanation on these keys. The 2 keys you generated work together. You always keep you private key for yourself. You will never have to send it to somebody. It is your property so keep it secure ;-) ! You public key will have to be sent to every single system you access.

The key generation process if finished. You can close PuTTYgen.
Now is the right time to add your key to the destination account you want to access. Let's say you want to access host1 and account account1. You need to add (or the host administrator) your public key to the file account1@host1:~/.ssh/authorized_keys2.

3 ) configuring PuTTY
Open PuTTY and configure the host you want to access. Click on ssh->auth and browse to get your private key file :<BR>


<img width='' height='' border='0' hspace='5' align='left' src='http://moon.homeunix.com:8080/blog/uploads/putty04.jpg' alt='' /><BR>



Now click back to session, give it a name and save it.

4) Configuring Pageant
If you try to connect to your host using PuTTY and your key, the system will ask for your passphrase. Unfortunately, FileZilla does not ask for a passphrase. So we need the help of Pageant to provide it for you to FileZilla. Pageant is called an ssh-agent. It is used to store your key and your passphrase and give it to client like PuTTY and FileZilla. This is very convenient if you work with a lot of servers. You enter your key and passphrase once, and you can login to any host without typing it again. Each time you start a new session, PuTTY will get its authentification info directly from Pageant.
Let's configure Pageant. Run it and look for it in your task bar. It is the little icon of a computer with a hat on :
<BR>


<img width='' height='' border='0' hspace='5' align='left' src='http://moon.homeunix.com:8080/blog/uploads/Pageant01.jpg' alt='' />
<BR>


Right click on it add key. Browse to get your private key. It will then ask you for you passphrase.

5 ) Using FileZilla to connect to your site

Finally you can open FileZilla. Configure your session. You should be able to connect using FTP over ssh2 to your host.