\definefilesynonym
  [font-lbr] [font-pos]

\usemodule		[pre-05]
\setupinteraction	[openaction=] % support acroreader 3

\let\section\Topic
\let\subsection\Subject

\setupexternalfigures[directory=images]
\useexternalfigure[fig:keypair-1][keypair-1][factor=max]
\useexternalfigure[fig:keypair-2][keypair-2][factor=max]
\useexternalfigure[fig:keypair-3][keypair-3][factor=max]

\starttext
\startstandardmakeup
\midaligned{{\tfd Gettin' Fancy}}
\midaligned{{\tfd with SSH Keys}}
\blank[2*big]
\midaligned{{\tfc Ed Cashin}}
\blank[6*big]
\midaligned{{\tfb CHUGALUG}}
\midaligned{{\tfc January 2001}}
\stopstandardmakeup

% \completecontent
% \page
\Topics{Topics}

\section{Why}

We would like to safely \dots

\startitemize
\item	run commands on remote machines
\item	transfer files over the network
\item	single sign-on
\stopitemize

\dots\ with everything encrypted.

\section{Secure Shell}

SSH is the secure shell.

\startitemize
\item	encryption
\item	replaces rsh, rcp
\item	uses advanced cryptography
  \startitemize
  \item	several algorithms
  \item	aware of man-in-the-middle, etc.
  \item	See ``RFC'' in distro.
  \stopitemize
\stopitemize

\section{Keys}

loose definition: {\it a sequence of bytes for use with a cryptographic
			algorithm}

\subsection{types of keys}

\startitemize
\item	host key
	
	generated at time of ssh installation

\item	session keys

	generated automatically each time you use ssh

\item	identity keys

	user level; generated with {\it ssh-keygen\/} utility
\stopitemize

\section{Single Sign-on}

\subsection{set up keys}

procedure:

\startitemize
\item	create key pair, ``foo,'' on localhost
\item	append {\it foo.pub\/} contents to remotehost's
	 {\it authorized\_keys\/} file
\item	edit entry in remotehost's {\it authorized\_keys\/} file if needed
\stopitemize

\placefigure[page]{key pair: generate}{\externalfigure[fig:keypair-1]}
\placefigure[page]{key pair: install}{\externalfigure[fig:keypair-2]}
\placefigure[page]{key pair: install}{\externalfigure[fig:keypair-3]}

remote host, ``B,'' will recognize an identity key if it's in its
{\it authorized\_keys\/} file.

\vfill

{\em You can have as many keys as you want.}

\subsection{ssh-agent}

gives multiple processes access to identity keys 

\startitemize
\item	uses sockets
\item	uses the environment to point to the sockets
\item	{\it ssh-add\/} utility hands the keys to the {\it ssh-agent}
\stopitemize

\page

\starttyping
# .xinitrc

exec ssh-agent icewm

# or ...
# exec ssh-agent sh -c \
  'ssh-add < /dev/null && exec wmaker'
\stoptyping

\vfill

\startitemize
\item	easy, but dangerous
\item	xlock, xscreensaver help
\stopitemize

\section{Tying Keys to Commands}

specify command in {\it authorized\_keys\/} file on remote host

\subsection{examples}

\startitemize
\item	echo 'Hello, World!'
\item	mt -f /dev/nst0 rewind
\item	nice -n 19 dd of=/dev/nst0
\item	nice -n 19 dd if=/dev/nst0
\stopitemize

\subsection{restrictions for safety}

\startitemize
\item	limit key to one command
\item	limit key to one host
\item	no {\it pty}, etc.
\stopitemize

\section{Applications}

\startitemize
\item	unattended remote secure backup
\item	secure remote logging
\item	sync data across machines
\item	etc.
\stopitemize

\page

\null
\vfill
\midaligned{fin}
\vfill

\stoptext