Setup SSH certificates for accessing a remote computer hosts without any prompts

In one of my projects, I wanted to be able to connect to and run shell commands on a remote Linux host computer without having to be prompted for :

(a) a login password and (b) host key fingerprint verification. 

Fingerprint prompt

For the first requirement, I discovered a tool called sshpass, which allows me to include the password in the command call to the remote host; but it is not able to return back the status of the remote command calls. For the second, I could setup host SSH certificates but I did not want to the overhead of having to create and maintain the certificates. 

The solution to achieve my objectives is described in the sections below. Basically I just needed to generate and sign my user certificate and have it authenticated by the remote SSH host when I ssh into the remote host; after setting up and configuring them, of course. 

Create user certificate authority keys

In order to generate user certificates, I need to use user certificate authority (CA) keys. The following steps outlines how to generate these keys.

1.  On a secure Linux workstation e.g. pc1, log in as a user e.g. pcuser and open up a Terminal. Key in the following commands to generate the user CA, e.g. user_ca.
   
   $ mkdir -p /path/to/ca/
   $ cd /path/to/ca/
   $ ssh-keygen -t rsa -b 4096 -f user_ca -C user_ca
   
   
   The private key user_ca and the public key user_ca.pub are generated.
   
   Note: change the certificate fie name prefix from user_ca to your desired prefix if necessary.
   
   

Setup the remote SSH host to recognize my user certificates

1.  On the remote SSH host, e.g. server1, open up a Terminal and copy over the previously generated user CA public key e.g. user_ca.pub.
   
   $ scp pcuser@pc1:/path/to/ca/user_ca.pub /tmp/.
   $ cd /etc/ssh/
   $ sudo mv /tmp/user_ca.pub /etc/ssh/.
   
   Note: where pcuser is the login used to generate the user CA keys on the workstation pc1.
   
   
2. Change the owner of the user CA public key file e.g. user_ca.pub to root.
   
   $ sudo chown root user_ca.pub
   $ sudo chgrp root user_ca.pub
   
   
3. Next, use a text editor to append the following TrustedUserCAKeys line into the /etc/ssh/sshd_config file. Save and exit the editor.
   
   $ sudo vi /etc/ssh/sshd_config
   ...etc...
   TrustedUserCAKeys /etc/ssh/user_ca.pub
   
   
   
4. Then type in the following command to restart the SSH daemon.
   
   $ sudo systemctl restart sshd
   
   The remote SSH host is now configured to recognize any user certificates signed using the user CA user_ca key files.
   
   

Use the user CA to issue my user certificates

1.  Back on the secure Linux workstation e.g. pc1, type in the following commands to generate a user certificate.
   
   $ cd /path/to/ca/
   $ ssh-keygen -f my-key -b 4096 -t rsa
   
   
   The private key file my-key and public key file my-key.pub are generated.
   
   
   
2. Now, sign the generated public key e.g. my-key.pub with the user CA public key e.g. user_ca.pub.
   
   $ ssh-keygen -s user_ca -I serveruser1@somedomain.com -n serveruser1 my-key.pub
   
   
   The signed user certificate my-key-cert.pub is generated.
   
   
   Note 1: where -I serveruser1@somedomain.com is a string identifier for system logs,
   -n serveruser1 is a comma delimited list of login user names on the remote host to be authorized for access.
   
   Note 2: include the -V option if you want to ensure the user certificate has an expiry date.
   
   
3. Optional. Run the following command to display information about the generated user certificate my-key-cert.pub.
   
   $ ssh-keygen -L -f my-key-cert.pub
   
   

Store and use the user certificate

1.  On the user's workstation, e.g. pc2, open up a Terminal and create a directory to store the generated user certificates e.g. /path/to/my-certs/.
   
   $ mkdir -p /path/to/my-certs/
   
   
2. Remove the group and others read, write and execute permissions of the newly created directory so that only the owner can access.
   
   $ chmod go-rwx /path/to/my-certs/
   
   
3. Copy over the user certificates my-key-cert.pub, my-key, my-key.pub generated in the previous section and place them into the /path/to/my-certs/ directory.
   
   
4. Finally, to ssh into the remote host e.g. server1 with the user certificate my-key, type in the following command.
   
   $ ssh -o StrictHostKeyChecking=no -i /path/to/my-certs/my-key serveruser1@server1
   
   You are authenticated and logged into the remote host server1 as user serveruser1 without any password or fingerprint prompt.
   

 

Configure an Ubuntu VirtualBox guest instance for ssh access from the host OS

I use VirtualBox to run guest OS such as Ubuntu 18.04 virtual machines for trying out stuff and experiments to prevent messing up my host operating system, e.g. Ubuntu. For convenience, the guest Ubuntu OS running in the VirtualBox can be accessed remotely from the host OS by creating a network adapter that bridges between the host and the guest. This post describes the configuration needed to allow the host OS to connect to the guest OS remotely through a secured shell (ssh).

The following steps assume an Ubuntu virtual machine has been created in VirtualBox and shutdown.

Create a bridge network adapter

1. Run VirtualBox.
   
   The VirtualBox Manager is displayed.
   
   
2. Select the Ubuntu virtual machine e.g. vm1. Click Settings.
   
   The Settings appear.
   
   
3. Select Network.
   
   
   
4. Select the Adapter 2 tab. Toggle on the Enable Network Adapter field.
   
   
   
5. Choose Bridged Adapter in the Attached to field.
   
6. In the Name field, choose the network you want the virtual machine to join, e.g. wlp3s0. Click OK.
   
   The bridged network adapter is created in the virtual machine.

 Identify the virtual machine's IP address on the bridged network

1. In VirtualBox, run the guest virtual machine, e.g. vm1.
   
2. Log in to the guest OS. Open up a Terminal.
   
3. Type in the ifconfig command at the prompt:
   
   A list of network adapters and related information is displayed.
   
   
   
4. Note down the virtual machine's ip address, e.g. 192.168.0.189.

Install SSH server
If the SSH server is not installed in the guest Ubuntu OS, then do the following steps.

1. Open a Terminal.
   
2. At the prompt, type in the command:
   
   $ sudo apt-get install openssh-server
   
3. At the prompt, type in the command to enable the ssh service.
   
   $ sudo systemctl enable ssh
   
4. Start the ssh service by entering the following command.
   
   $ sudo systemctl start ssh
   

Remote access to the guest virtual machine
Now the virtual machine can be accessed from the host operating system. With the virtual machine running, the following commands can be used to access the guest OS.

1. Open up a Terminal. Type in the following command:
   
   $ ssh remote_user@192.168.0.189
   
   Note: where remote_user is the login name for the guest OS and 192.168.0.189 is the IP address of the virtual machine on the host's network.
   

Setup to launch ROS nodes on a remote computer on a network

ROS nodes can be setup to run on a remote computer from a local computer on the same network. However, there are some setup to be done. After reading the tutorials and trying out on my own, the following steps summarized what worked for me.

Create known hosts
On the local Linux computer e.g. a Raspberry Pi (local1) do the following:

1. Open a Terminal.
    
2. Type in the command.
   
   $  ssh -oHostKeyAlgorithms='ssh-rsa' remote_user1@remote1
   
   The prompt appears: Are you sure you want to continue connecting (yes/no)?
   
3. Type in yes. Press RETURN.
   
4. When prompted, type in the password for the remote1 computer's remote_user1.
   
   The Terminal is now connected to the computer remote1 and remote_user1 is logged in.
   
   The remote1 computer name is encrypted with the RSA encryption and stored in the Raspberry Pi's /home/local_user1/.ssh/known_hosts file.
   
   
5. Type in exit.
   
   The connection to remote1 is closed.
   
6. If necessary, repeat the previous steps 2 to 4 for the IP address of the computer remote1.
   
   $ ssh -oHostKeyAlgorithms='ssh-rsa' user1@192.168.8.101
   
   Note: where 192.168.8.101 is the IP address for the computer remote1.

Create SSH public and private keys for authentication

1. On the local1 computer, open a Terminal.
   
2. Type in the command:
   
   $ ssh-keygen -t rsa
   
   Enter file in which to save the key (/home/local_user1/.ssh/id_rsa):
   
3. Press RETURN.
   
   Enter passphrase (empty for no passphrase):
   
4. Press RETURN.
   
   Enter same passphrase again:
   
5. Press RETURN.
   
   The private key is generated in /home/local_user1/.ssh/id_rsa.
   The public key is generated in /home/local_user1/.ssh/id_rsa.pub.

Install the public key(s) to the remote computer

1. On the computer local1, open a Terminal.
   
2. Type in the command:
   
   $ ssh-copy-id remote_user1@remote1
   
3. When prompted, type in the password for remote_user1.
   
   The public keys are installed on computer remote1.

Create a remote ROS environment shell script file
The following steps should be executed on the remote computer remote1.

1. Using a text editor, create a shell script file e.g. /opt/ros/melodic/env_remote1.sh with the following content.
   
   

   #!/bin/bash
   
   export ROS_MASTER_URI=http://remote1:11311
   
   source /opt/ros/melodic/setup.bash
   source /home/remote_user1/catkin_ws/devel/setup.bash
   
   exec "$@"
   

   
   
2. Open a Terminal. Make the shell script executable.
   
   $ sudo chmod a+x env_remote1.sh
   

Create and run local launch file
The following should be done on the local computer local1.

1. Using a text editor, create a launch file e.g. run_remote.launch.
   

   <launch>
           <machine
                   name="remote1"
                   address="remote1"
                   env-loader="/opt/ros/melodic/env_remote1.sh"
                   default="true"
                   user="remote_user1"
           />
           <node machine="remote1" pkg="beginner_tutorials" name="hello_doubles" type="hello_doubles" />
   </launch>
   

   
   Note: this launch file will run the hello_doubles node from the beginner_tutorials package on the remote1 computer.
   
   
2. Open a Terminal. Type in the following command assuming the launch file is in the current directory:
   
   $ roslaunch remote.launch
   The following messages may appear. Ws06 in this example screenshot is the remote computer.
   
   

Setup an Ubuntu VM instance on a Windows host for remote ssh access

An Ubuntu VM VirtualBox instance running as a guest OS on a Windows host can be remotely accessed via the secured ssh shell but the VirtualBox and the host OS must be configured to allow the networking traffic to pass through the ssh ports. The basic steps are: (a) to configure the Windows firewall, (b) to configure the port forwarding in Oracle VirtualBox, and (c) to install and setup the ssh server on the Ubuntu instance.

Open up the Windows firewall for Oracle VirtualBox

1. In Windows, search for the Windows Defender Firewall with Advanced Security App and open it.
   
   
   
2. Select Inbound rules. Check the VirtualBox Manager rules and if they are not enabled, double click and enable the rules.
   

Forward the TCP ssh ports to the Ubuntu VM

1. Start Oracle VirtualBox.
   
   
   
2. Select the Ubuntu VM, e.g. Ubuntu19. Click Settings. Then click Network.
   
   
   
3. Click Port Forwarding.
   
   
   
4. Click the Plus icon. Add in a new rule for Ssh with the Host Port set to 3022 and the Guest Port set to 22.
   
   Note: 3022 would be the port number to use to remotely access the Ubuntu VM.
   
5. Click OK to all the dialog boxes.

Install openssh-server on the Ubuntu VM

1. In Oracle VirtualBox, start the Ubuntu VM, e.g. Ubuntu19.
   
2. Optional. If the openssh-server is not installed, then open up a Terminal and run the following command.
   
   $ sudo apt install openssh-server
   
   
   
3. After the installation is completed, either reboot or restart the ssh service with the following command.
   
   $ service ssh restart
   

Remote access via ssh

1. On a remote PC, open up a Terminal.
   
2. Type in the following command to connect to the remote Ubuntu VM instance.
   
   $ ssh 192.168.8.157 -p 3022
   
   Note: where 3022 is the port number and 192.168.8.157 is the example IP address of the Windows PC hosting the Ubuntu VM instance.The ssh prompt appears.