Ditch your passwords with Secure Sockets

Secure Sockets are super useful. And it is worth knowing how to set them up for use on a Raspberry Pi. I’m just documenting these things here so that I can refer back to this post whenever I need to remember what to do.

The situation is this: You’ve just set up a new Raspberry Pi using the wonderful Raspberry Pi Imager software. You’ve set the machine name, enabled SSL and configured the WiFi so that the Pi will wake up and connect to your network. Next you need to make it easy to connect to. Let’s start with the first part, creating an SSL identity on your new Pi.

You perform this first step on your Pi. You’re going to make a folder to hold keys and a unique key that will identify this device. The first thing you do is connect from the console on your computer (in my case a Windows PC) to your new Pi. If you’ve set the Pi up to use SSL and Password authentication (which is what I do) then you open a command prompt on your PC and type:

ssh printserver.local -l rob

The ssh command above has two arguments. The first is the network address of the machine on the local network. This is the machine name followed by “.local”. I’ve just made a new machine called printserver, so I’m going for printerserver.local. The second argument (after the -l - which is lower case L by the way) is the username that you created on the Pi. If you leave this out the ssh call will use the username from the machine you are using to connect. If you call yourself the same name on everything this will work, but it didn’t for me. I created the pi with the username “rob” because I am an egomaniac. Your name might be different.

After you have entered this command you will be asked to confirm that you want to add this machine in your local key store on your PC. You do, so say yes. Next you will be asked for the password for the user on the Pi (in my case the password for rob) and then you will be logged in as a terminal user on the machine.

Now you want to give your new machine a unique identity in the world and set up a key storage location. Issue the command below:

ssh-keygen

You will be asked a series of questions. Just press return after each of them. Now you have a key storage on your device, along with an SSH key for that device. Now you switch back to the terminal on your PC. What you are going to do now is copy the key from your PC onto your new Pi. This is good because it means you’ll be able to open an SSL ternal session without entering a password. It’s also good because any programs that want to use SSL (for example Visual Studio Code remote terminal) will be able to work seamlessly.

cat ~/.ssh/id_ed25519.pub | ssh rob@printserver.local 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys'

This is one long command. For the record, cat is a command to copy files, I sent mine using the username rob and to the device printserver. You will probably need to change your command. This pre-supposes that you already have keys on your computer to send. You can use the command ssh-keygen on your computer to set that up first if you need to.

If you have done everything right you should be able to login using the ssh command we saw at the top of the post and not be asked for a password. Which is nice.