GitHub SSH 연결Connecting to GitHub over SSH

SSH keys let you connect to GitHub securely. This post explains how to connect to GitHub with an SSH key and how to fix the problems you may run into along the way.

SSH(Secure Shell)

SSH (Secure Shell) is a network protocol that lets computers communicate securely over a network such as the internet.

One of SSH’s key features is “encryption”. SSH encrypts everything it sends, so data traveling over the network isn’t exposed to others. This keeps sensitive information safe and protects it from attackers. SSH uses asymmetric keys for encryption.

Asymmetric Keys

To connect to and use GitHub over SSH, it helps to understand asymmetric keys. The big picture is:

1. There are two keys that encrypt & decrypt data = a key pair.
2. The private key (identification) and the public key (Public Key)
   • Private key: a key you must never share
   • Public key: a key anyone can have and use
3. Each key is used for encryption and decryption. What one key encrypts can only be decrypted by the other
   • What is encrypted with the private key can only be decrypted with the public key.
   • What is encrypted with the public key can only be decrypted with the private key.

Which Key Goes Where?

The keys registered on GitHub are visible to anyone. Add user_id.keys to the URL and anyone can see the keys a user has registered. A key anyone can see means GitHub holds the public key, right? Conversely, the key we have to keep is the other one, the private key.

https://github.com/tiaz0128.keys

> Anyone can see the public keys a user has registered on GitHub

Thinking It Through with a Private Repository

A public repository lets anyone view and download the source code, so let’s set that aside and take a private repository as the example, where only I can push and pull code.

What if you registered your private key on GitHub? Anything encrypted with the private key could be decrypted with the public key, which anyone can have, so you couldn’t prove that you’re you. In other words, the user can’t be authenticated.

> No way to tell which one is real

That’s why GitHub uses the public key and verifies authentication with the user’s private key, guaranteeing that data is transmitted safely.

Generating and Registering an SSH Key

1. Check Whether Your System Already Has an SSH Key

On Linux/Mac, first check the user’s .ssh folder. Use the command below to look for asymmetric key pair files.

$ ls -la ~/.ssh

On Windows, check the .ssh folder inside your user folder under Users.

> ls C:\Users\{user_id}\.ssh

> ls C:\Users\tiaz\.ssh

2. If There’s No Public Key, Generate a New SSH Key

If you don’t have a key pair, you can generate an SSH key with the following command. It creates a new SSH key pair and attaches your email address to the key.

$ ssh-keygen -t rsa -b 4096 -C "{email}" -f {file_path}

$ ssh-keygen -t rsa -b 4096 -C "tiaz0128.dev@gmail.com" -f ~/.ssh/github

> ssh-keygen -t rsa -b 4096 -C "{email}" -f {file_path}

> ssh-keygen -t rsa -b 4096 -C "tiaz0128.dev@gmail.com" -f c:\Users\tiaz\.ssh\github

• -t rsa: the type of key to generate
• -b 4096: the key length in bits
• -C "{email}": optional. A comment attached to the key, making it easy to tell which service the key is for
• -f {file_path}: the path and file name of the key to generate

When you run ssh-keygen, it asks for a passphrase. If you set one, you have to enter it before the private key can be used; if you don’t, you won’t need to enter anything when using the private key. So whether to set a passphrase is a trade-off between convenience and security. Here I’ll just press Enter.

Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): ↵
Enter same passphrase again: ↵

Looking at the generated files, you’ll find two files: the key pair. Of these, the key with the .pub extension is the public key, and the other one is the private key (identification).

The key pair’s fingerprint is a unique hash of the key used to identify it. The randomart image is a visual representation of the fingerprint that helps you quickly spot whether a key has changed.

Your identification has been saved in c:\Users\tiaz0\.ssh\github
Your public key has been saved in c:\Users\tiaz0\.ssh\github.pub
The key fingerprint is:
SHA256:cyboaD4Jn1nZXehR0WXLBQ+DR529JprwL5kfsAxZP0M tiaz0128.dev@gmail.com
The key's randomart image is:
+---[RSA 4096]----+
|            .==+*|
|            o +*=|
|           + E oo|
|       . .= +. o |
|      .oS==+o+o  |
|  .  oo .==+o o  |
|   oo=.    o+.   |
|   o*      + ..  |
|    ..      o.   |
+----[SHA256]-----+

3. Add the Public Key to Your GitHub Account

Copy the contents of the public key, then paste it into the SSH keys section of your GitHub account settings. Log in to GitHub, click your profile in the top right, and register the public key under setting - SSH.

> Save the SSH public key in GitHub - setting.

4. Check That You Can Connect to GitHub over SSH

Let’s check that the public key was registered correctly. The command below tries to connect to GitHub and prints a message like the following if it succeeds.

ssh -T git@GitHub.com

Hi tiaz0128! You've successfully authenticated, but GitHub does not provide ...

Removing a Key

To remove a registered key, specify it with the -d option.

ssh-add -d ./github

Troubleshooting

Could not open a connection to your authentication agent

This error means the SSH authentication agent isn’t running or can’t be reached. To fix it, start the SSH authentication agent first. The error message and the fix differ slightly by operating system.

Could not open a connection to your authentication agent

$ eval "$(ssh-agent -s)"

On Windows, try the command below with administrator privileges. If that doesn’t work, open Services yourself and enable the OpenSSH Authentication Agent service.

Error connecting to agent: No such file or directory

> Start-Service ssh-agent

> Windows Services - OpenSSH Authentication Agent

> Enable SSH.

Then run ssh-add again to add the SSH key to the authentication agent.

$ ssh-add ~/.ssh/{private_key}

$ ssh-add ~/.ssh/github

> ssh-add  c:\Users\{user}\.ssh\{private_key}

> ssh-add  c:\Users\tiaz\.ssh\github

WARNING: UNPROTECTED PRIVATE KEY FILE

This error means SSH ignored the private key file because its permissions are too open. To fix it, change the private key file’s permissions with the following command.

$ chmod 600 ~/.ssh/{private_key}

$ chmod 600 ~/.ssh/github

Writing an SSH config File

The SSH config file stores SSH connection settings. With it, you can easily manage SSH connection settings for many servers. Just create a file named config in the .ssh folder.

The file can contain settings like these:

• Host (optional) : an alias you use in SSH commands instead of the HostName to refer to the connection settings.
• HostName : the actual host name or IP address
• User : the user name to log in with on that host
• IdentityFile : the path to the private key file used to connect to that host
• Port : the port number used to connect to that host

Here’s an example config file for github.com.

Host github.alias
  HostName github.com
  User git
  IdentityFile ~/.ssh/github

• Using the Host alias github.alias,
• log in to github.com as the git user,
• with the ~/.ssh/github key file

You can use this setting like so:

# With a Host alias, you can refer to it by the alias.
$ git clone git@github.alias:tiaz0128/tiaz0128.github.io.git

# Without an alias, use the real host name
$ git clone git@github.com:tiaz0128/tiaz0128.github.io.git

1. You can use SSH when cloning a repository through the Host alias github.alias.
2. Without a Host alias, use the HostName as is.

I Want to Use Both My Personal and Work Accounts

This happens: during lunch, you want to push to your personal repository from your work computer. Logging in and out every time, deleting credentials and adding them back… it’s often a real hassle.

If you’ve followed everything so far, SSH comes in handy here. You can register several different accounts and switch between them easily. Let’s set up the scenario.

• I want to use several GitHub accounts on one computer.
  • Personal account : tiaz0128
  • Work account : dev0128
• Each GitHub account has a different public key registered.
• The private key paired with each public key is stored on the computer.

Using the Host value in the config file solves this neatly.

1. For GitHub, write the fixed values HostName = github.com & User = git
2. Set IdentityFile to the private key paired with each account’s public key
3. Write Host so you can tell which key to use

# Personal key
Host github.private
  HostName github.com
  User git
  IdentityFile C:\Users\tiaz\.ssh\private

# Work key
Host github.company
  HostName github.com
  User git
  IdentityFile C:\Users\tiaz\.ssh\company

Using the registered Hosts, you can clone repositories with each account’s private key. Once cloned this way, you can push as the account each repository is tied to.

> git clone git@github.private:tiaz0128/private-project.git

> git clone git@github.company:dev0128/company-project.git

VScode extension : Remote - SSH

This extension makes it easy to connect over SSH from VScode. It lets you install other VScode extensions on the remote target, which makes things like connecting to servers much easier when working in the cloud.

> Source: Remote - SSH

Wrapping Up

SSH encrypts and decrypts using an asymmetric pair of keys: a private key and a public key. Whatever one key in the pair encrypts, the other can decrypt. This can be used to authenticate users.

We also saw how to save settings in a config file and use the Host value to talk to one service with multiple accounts. I used GitHub as the example here, but the basic idea is the same for any other service you communicate with over SSH. 😊