5.1 Git and Linux SSH

Using GIT to store config information

Install git

Clone a private repo to log in (it might not take a password, if not follow the instructions on these pages to set up a login token and cache it):

• https://dev.to/shafia/support-for-password-authentication-was-removed-please-use-a-personal-access-token-instead-4nbk
• https://stackoverflow.com/questions/68775869/message-support-for-password-authentication-was-removed

I don't totally understand this but the way I think it works is below

• login using the token you generated
• run git config --global credential.helper cache
• When you want to do something that requires credentials use git [thing] -v to use those credentials to verify

Navigate to the directory cloned and, if necessary, make a new folder for your config files

• ex. "docker01"

Copy the relevant files to the current directory (the below is how I did it)

• cp /etc/netplan/00-installer-config.yaml ./00-installer-config.yaml
• cp /etc/cloud/cloud.cfg ./cloud.cfg
• cp /etc/hosts ./hosts

add, commit, and push

• git add . - adds what the git command will commit and push to the online repo, in this case "." indicates the whole current directory
• git status
• git commit -m "note here" - commits the changes to be pushed
• git push - push the changes to the repo

A little more on git

Git is a tool we used in this lab to "pull" and "push" data from an online repository. For our uses, this makes it very easy to transfer data to and from different devices, such as configuration information, that might be the same or similar for different devices. It also provides a backup for such data that is not on a single host machine.

Secure SSH

Create a public and private keypair to use for password less ssh later:

• ssh-keygen -t rsa -C "sys265" - Make sure to remember your passphrase if you set one!

Copy the PUBLIC KEY ONLY to your git repo, add, commit, push!

Now create a user that can use that keypair by pulling the public key from the repo (this set of commands makes a user called sys265):

• sudo useradd -m -d /home/sys265 -s /bin/bash sys265
• sudo mkdir -p /home/sys265/.ssh
• sudo cp /home/echadbourne/ChadbourneSYS-265/linux/public-keys/id_rsa.pub /home/sys265/.ssh/authorized_keys
• sudo chmod 700 /home/sys265/.ssh
• sudo chmod 600 /home/sys265/.ssh/authorized_keys
• sudo chown -R sys265:sys265 /home/sys265/.ssh

To use this new user, go to a different vm (like web01) and ssh to the computer you were just using (docker), like so:

• ssh sys265@docker01-elizabeth - then enter the passphrase if you made one

Finally, create a script to do all of the following, but uses a username that is passed as a parameter in place of sys265. See this document:

• https://github.com/echadbourne/ChadbourneSYS-265/blob/main/linux/centos7/secure-ssh.sh

A little more on keypairs

I wanted to just quickly explain how the keypairs work. The keypair that we made in the lab is a public and a private key that can work together to encrypt and secure connections. Essentially, the public key becomes a password that only works with the corresponding private key. This means the public key can be put into a public repo, and it will only work to provide authentication on a device that already has the corresponding private key.

The private key will never move from the host device.

In this lab we simply set up a user all prepared with the public key so they can very easily ssh into the computer possessing the public key.