Perhaps a better title might be “God N googles ‘server refused our key’ and eventually gets the answer he wants.” Or needs. Either way, after trying for a week or so, I’m finally able to login to my favorite CentOS 6 servers without typing my username and password.
Originally, I thought I’d note the solution down in my little black book of links, but then I noticed that the linkee was a blog that hadn’t been updated since 2010 and had only three posts. What if it fell off the net? Things do. It’s the reverse of the the 60s building boom in Chicago: “That building wasn’t there this morning.” Now it’s, “That page was there ten minutes ago.” Clearly it was time to start the blog I’d been waffling about for months.
So here are the exact steps to follow religiously if you’re Putty-ing from a Windows® box to a Linux box. I prefer CentOS over other Linux distributions, but these steps should work for all modern Linuces.
Step Zero: Remember what Pirsig says. You’re here because you’re stuck. You’re probably pissed, if not furious. Imagine Detective Matt Sikes pounding his steering wheel and headliner while Sam Francisco looks on in amusement. That’s your state of mind. Stuck. What’s Robert Pirsig got to do with anything? “Cultivate being stuck,” he says. You’re still pounding your roof. Why
cultivate such a state?
Because you’re not there that often. Think about it. When’s the last time you were stuck? Really stuck, not that wimpy, “Oh, darn, this graphics card is 25mm too long and will bang into my memory” kind of irritation. Irritation doesn’t count, because in that situation, you know immediately what to do. Buy low-profile memory. Full duration of stuckness? Too brief to measure. No, what you’re looking at is the kind of stuckness you get when you’ve been (admit it) trying the same exact thing over and over and over again, expecting different results, for at least a week.
Now you’ve eaten all the chocolate in the house. You’re making trips to 7-11 at midnight to get more, and you don’t really like what you can get there. You’re here because you’re ready to pop a blood vessel in your brain, and you’re thinking it might not be all bad if it blows.
So. Live in the moment. There is no past. No future (especially if you don’t succeed in getting Putty to log you in with a private key). Only the present, in which you are Stuck. In more ways than one. You’re going nowhere. In more ways than one. Cultivate being stuck: let the problem you’re obsessing about fall out of your consciousness and your mind run loose. Observe the pain you’re feeling. Float above it. Meditate in and on that state. Stop analyzing every step: that’s what got you here. Keep your mind open for solutions to other problems. “One more google,” you think. “What can it hurt?” Well, you might
flounder in the red mist, banging your head against the wall for another
week or so. Or, you might run
across an ancient Mayan God who’s got the answer.
Here it is.
Step One: Login to your Linux box conventionally and
chmod 755 ~.
Really. Do it now. If you don't do that first, even if you already KNOW it’s mode 755, then none of the following will work.
Step Two: While still logged in,
mkdir .ssh; chmod 700 .ssh; cd .ssh; touch authorized_keys; chmod 600 authorized_keys
You can copy the above line, paste it and hit enter. Then make SURE that .ssh and .ssh/authorized_keys belong to you. Do a
chown me:mygroup on the directory (~/.ssh) and the file (~/.ssh/authorized_keys). Do it now so you don’t forget.
Step Three: On your Windows system (and this should work on any version of Windows on which Putty runs), go to (i.e., “if you’re running Windows 8, jab randomly at the screen until you get a search box”) your Start Menu (Windows key is probably fastest; on Windows 8, it’s the Windows key + S) and type “puttygen” into the search box. Hit Enter. If it tells you it doesn’t know what you’re talking about, visit the Putty home page (skip the “improved” variants: they add nothing of value) and download the Putty installer package. Even if you’re running Putty as we speak, download the installer package and install it. It won’t nuke your precious settings: they’re kept in the registry, and they’re safe. Once you install, either repeat the search or double-click
puttygen.exe because you know where it lives now. The idea is to run
puttygen and get this:
I know. You’ve done all this. That’s OK. You’re cultivating being stuck, remember?
Step Four: Hit the Generate button. Wiggle your mouse to make the green bar move across the pane. Once it gets enough randomness, it will generate a public key, which you can see in the “Public key for pasting ...” window.
Step Five: Type your passphrase into the appropriate input box. Do it BEFORE you save the private key. Pick a phrase that you can easily remember, and one that you can ALWAYS spell the same way. If you pick one that has a word that might end in either a consonant or a vowel and the phrase makes sense either way, PICK A DIFFERENT PHRASE. Seriously. Pick a phrase that you can be confident that you can type without error. If you forget and misspell, nothing will work—and you’ll end up here again, only this time I’ll say “I told you so.” And I’m not very good at forbearance.
Step Six: Hit “Save private key.” That’s it. Name the file something that ends in .ppk that you can remember and find again later.
Step Seven: Copy the public key from the “Public key for pasting...” window.
Step Eight: On your Linux box, use your favorite editor to edit the authorized_keys file that you touched in your ~/.ssh directory. I use vim, so my command would be “vim authorized_keys” (or whatever alias you use: I alias “vi” to “gvim”).
Step Nine: Paste what you copied in step Seven into the authorized_keys file. Make certain it’s all on one line. Contrary to other pages/posts,
do include the comment. That’s the part after the ‘== ’ near the end. Save the authorized_keys file and exit from your editor. Check that the permissions on the file are still 600.
Step Ten: Start
pageant. This is one of the accessory programs in the Putty installer package that you should have downloaded in step three. You should be able to figure out how to run it by now (hint: it’ll be in the same directory as puttygen). You’ll see this:
Step Eleven: Press the “Add Key” button. Browse to where you saved your private key file. (Note: you’ll have to do this every time you run the program. More about this later.) Double-click your private key file. You should see something like this:
Step Twelve: Click the “Close” button. Don’t worry,
pageant will keep running in the background.
Step Thirteen: Start
putty. Load the values for whatever linux system you want to login to without using a password. The system I want to login to is named “Ta-Witz” (shit mountain in Ch’ol, one of the 60+ Mayan languages. More later).
Step Fourteen: Cruise to Connection->Data, and fill in your username on your server in the “Auto-login username” field:
Step Fifteen: Select Connection->SSH->Auth, and make sure that “Attempt authentication using Pageant” is selected (that’s the default, so it should be):
Step Sixteen: Select Session, and push “Save.”
Step Seventeen: At this point, you should be able to double-click the appropriate host name in the Putty window (or double-click your previously created desktop shortcut), and see the following:
If you don't see your shell prompt, you did something wrong. Go back through all previous steps and fix each problem as you come to it. Don’t worry, you’ll see it. Eventually.
Step Eighteen: You’ll need to create a shortcut in your Windows startup directory. In the “Location” field, type the following, with appropriate substitutions for your system:
C:\Putty\PAGEANT.EXE "C:\Users\<yourname>\latest-key.ppk"
What this will do is ask you for your secret passphrase when you start Windows (or login). You won’t have to type it again until you restart.
To apply to other Linux systems, all you should have to do it copy your authorized_keys file over to them. You can, if you desire, then disable the ability to login with passwords. This is only a good idea if you are
certain that no one else will need to use a password.
If you’re still having trouble, I can only tell you the following anecdote, about giving a 1975 Gremlin a minor tuneup. I’d done many tuneups before, and they usually took about an hour. Two weeks after I started, I tightened down the bolts on the head after having installed a new gasket. I turned the key and listened to the engine, for perhaps the 400th time. “Still runs like shit,” I told my brother. He shrugged as helplessly as I felt.
I decided that the only thing left was that I had accidentally constricted the exhast system during the “tuneup.” It was a (very) long shot, but it was all I had. I drove the car, sputtering and banging and shimmying to beat the band, to Midas Mufflers, where they dutifully sold me a new muffler system. I started it up. “Shit,” I said, “it’s still running terribly.”
“That sounds like firing order,” said the head mechanic.
“Nah. It’s 1-5-6-3-2-4. That’s the first thing I checked.”
“Let’s look at the manual.” He opened the book, popped the hood, looked at the page, swapped the two middle spark plug wires and said, “Start it up again.”
Never has an American Motors straight 6 run so smoothly. Or caused greater embarrassment to a shade-tree mechanic. 35 years later, I still remember the correct order: 1-5-3-6-2-4. Hang on, I better check the manual again.
Note
According to Nick Hopkins, a respected linguist and Mayanist, “Ta-witz” does not mean “Shit mountain.” Instead, it’s “shit of the mountain,” a rather different proposition. I had modelled the construction on a statement I read somewhere by Sir J.E.S Thompson to the effect that the Mayan name for the common vulture was “ta’ hol,” “shit head.” Here’s what Nick has to say:
“Ta’-hol” for vulture derives from an earlier tan-hol, “ash-head,” as in
some other languages, referring to the gray head and neck of the common
vulture (as opposed to the red-headed turkey vulture). It’s all too easy
to go from tan-hol to ta-hol (lose the n) to ta’-hol (add the glottal
stop in a “folk etymology”).
Since it’s way too late for me to change the name of the server to the correct (in Ch’ol), “tya’-bä witz” (“mountain made of shit”), I’m just going to live with it. I should’ve checked with Nick five or six years ago when I named it.