jpunch

OpenSSH Public Key Authentication (passphrase-free login)

The ssh login generally requires the user to input the passphrase. The messaging mechanism (described below) uses ssh remote execution. It connects to the remote host with the given credentials, executes a given command, collects the result (command output) and disconnects. Each login requires user to manually input the passphrase. To simplify the process the Public Key Authentication can be used. This chapter describes how to setup passphrase login between the hosts A and B. First we need to generate the keys (private and public) if have not yet.

userA@A:~$ mkdir ~/.ssh

userA@A:~$ cd ~/.ssh

userA@A:~$ ssh-keygen -t dsa

Second we need to copy a public to the remote host. Note, that scp also uses the ssh-tunnel to connect to host B. (The connection to userB@localhost -p 10022 will be forwarded to userB@hostB)

userA@A:~$ scp ~/.ssh/id_dsa.pub userB@localhost: -p 10022

Finally, log into the host B and add the uploaded public key id_dsa.pub to the list of authenticated keys

userA@A:~$ ssh -42Cvc blowfish userB@localhost -p 10022

...

Password: ***

...

userB@B:~$ cat ~/id_dsa.pub >> ~/.ssh/authorized_keys

userB@B:~$ rm -rf id_dsa.pub

userB@B:~$ exit

At this point a copy of your key is now stored on the remote machine as an authorized keys and any ssh connection coming from the local machine will match that key and connect with the key authentication instead of a password. Do not forget to do the same on the second host

userB@B:~$ mkdir ~/.ssh

userB@B:~$ cd ~/.ssh

userB@B:~$ ssh-keygen -t dsa

userB@B:~$ scp ~/.ssh/id_dsa.pub userA@localhost: -p 10022

userB@B:~$ ssh -42Cvc blowfish userAlocalhost -p 10022

...

Password: ***

...

userA@A:~$ cat ~/id_dsa.pub >> ~/.ssh/authorized_keys

userA@A:~$ rm -rf id_dsa.pub

userA@A:~$ exit

Messaging mechanism

Two instances of JPunch running on different hosts A and B can send messages to each other using input/output redirection. In other words the output of JPunch (running on A host ) will be forwarded to the input of JPunch of B host and vice-versa. All we need are possibility to ssh between theese hosts and passphrase-free logins. Establishment of relayed ssh connections and public key authentication are already described above. Next we need to define pipes for redirecting input/output on each host. The pipes can be created using following mkfifo command

userA@A:~$ mkfifo /tmp/pipe1

userA@A:~$ mkfifo /tmp/pipe2

and on B host

userB@B:~$ mkfifo /tmp/pipe1

userB@B:~$ mkfifo /tmp/pipe2

The I/O of JPunch can be redirected using linux redirection operators < (in) and > (out)

userA@A:~$jPunch/sh run.sh < /tmp/pipe2 > /tmp/pipe1

So the output will be collected into pipe1 and the input will be taken from pipe2. Now we need to transport the data between the pipe1 of the host A and the pipe2 of the host B (and vice-versa). As we have passphrase-free logins between two hosts, we can use the remote execution. The next script will always take the data from pipe1 of the host B and put it into the pipe2 of the host A.

userA@A:~$while [ true ]; do \

ssh -42Cvc blowfish userB@localhost -p 10022 "cat /tmp/pipe1" > /tmp/pipe2; \

done;

same for host B

userB@B:~$while [ true ]; do \

ssh -42Cvc blowfish userA@localhost -p 10022 "cat /tmp/pipe1" > /tmp/pipe2; \

done;

The script uses established ssh-tunnel to the B host. (ssh -42Cvc blowfish userA@localhost -p 10022). Next we add the remote execution of "cat /tmp/pipe1". That will take the data from the pipe1 of the remote host and put it into the pipe2 on the localhost (> /tmp/pipe2). The while loop will repeat the remote execution. Now the messaging between different Jpunch instances is working properly. So the JPunch is provided with the back-end for the configuration exchange. The described while loop should be started before the main program. It is reasonable to have two different terminals for the loop and for the JPunch program. Host A Terminal #1

userA@A:~$while [ true ]; do \

ssh -42Cvc blowfish userB@localhost -p 10022 "cat /tmp/pipe1" > /tmp/pipe2; \

done;

Terminal #2

userA@A:~$jPunch/sh run.sh < /tmp/pipe2 > /tmp/pipe1

Host B Terminal #1

userB@B:~$while [ true ]; do \

ssh -42Cvc blowfish userA@localhost -p 10022 "cat /tmp/pipe1" > /tmp/pipe2; \

done;

Terminal #2

userB@B:~$jPunch/sh run.sh < /tmp/pipe2 > /tmp/pipe1