002_ssh.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "source": [
    "<a href=\"https://colab.research.google.com/github/rzl-ds/gu511/blob/master/002_ssh.ipynb\" target=\"_parent\">\n",
    "    <img src=\"https://colab.research.google.com/assets/colab-badge.svg\"/>\n",
    "</a>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# `ssh`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "almost all of the work we do in this course will be done on the linux command line, and the way we will be accessing that command line is from our laptops via `ssh` (**S**ecure **SH**ell)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "## what is `ssh`?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "have you used `ssh` before? from that perspective, what is it?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "basically, [`ssh`](https://en.wikipedia.org/wiki/Secure_Shell) is a protocol for connecting to a remote server and executing commands in a \"shell\" (an interpreted environment where certain commands and programs are available to us via short typed commands) on that server."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "this requires a few things\n",
    "\n",
    "+ a \"server\"\n",
    "    + some computer (besides ours) which is actively running a process which can\n",
    "        + listen for requests in this protocol\n",
    "        + interpret those requests\n",
    "        + check if a request is authenticated (i.e. is an approved user with approved credentials), and\n",
    "        + build connections and shells for remote users\n",
    "        + note: [windows `ssh` servers exist](https://blogs.msdn.microsoft.com/powershell/2017/12/15/using-the-openssh-beta-in-windows-10-fall-creators-update-and-windows-server-1709/), but the vast majority of all `ssh` servers you will encounter are running linux"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "+ a \"client\"\n",
    "    + this is *our* computer, and\n",
    "    + some program (e.g. `putty` on old Windows machines, the [Windows `ssh` command](https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh) on new Windows machines, or `ssh` on linux or mac), and\n",
    "    + an internet connection (not guaranteed!)\n",
    "\n",
    "*semantics note: this paradigm of a \"client\" asking for something and a \"server\" responding with it is a ubiquitous design pattern*"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "## why use `ssh`?\n",
    "\n",
    "first of all, it is secure. it encrypts all messages before transport (so if someone malicious is eavesdropping it doesn't matter), and neither side of the connection knows all of the details that made it secure (i.e. both sides have secrets) -- more on this in the homework.\n",
    "\n",
    "second of all, it's standard. it is not the only method of secure communication, but it is almost universally supported."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "## security and `ssh` keys\n",
    "\n",
    "when making a connection, users generally need to authenticate. Typically this involves logging in *as* some authorized user, and although the default method of authentication in linux systems is user name and password, `ssh` communication has a secondary method of authenticating -- **`ssh` keys**."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "In one of this week's exercises you will walk through some of the underlying math of `ssh` public/private key authentication, but for now the primary message is this:\n",
    "\n",
    "+ clients (you) have a **private** key\n",
    "+ clients (you) send servers (remote) a **public** key\n",
    "+ these keys are used by both computers to\n",
    "    + securely communicate a special message (an encryption key)\n",
    "    + prove respective identities (authenticate)\n",
    "+ after this, all communication is encrypted using that encryption key\n",
    "\n",
    "advanced note: the private and public keys come in several different formats (most commonly: `ppk` for windows and `openssh` for linux) and represent different algorithms (most commonly: RSA)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "<div align=\"center\"><img src=\"http://drive.google.com/uc?export=view&id=1sl8ah8DVSKhzk-kdu5yiW1VDTXWJ6sRp\"></div>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "the next two sections will discuss using `ssh` from both windows and linux-like environments. Although *your* laptop is one or the other, it is extremely likely you will need to make connections from the other at some point -- knowing how to navigate `ssh` from both environments is absolutely necessary!\n",
    "\n",
    "though the methods might seem different, they are going to ask you the same things:\n",
    "\n",
    "1. what is the address of the server to which you want to connect\n",
    "1. what is your name on that server\n",
    "1. what should we send the remote server to authenticate (a password or `ssh` key pair)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "let's collect some of that info. open a scratch file (notepad or whatever) so we can copy/paste some info.\n",
    "\n",
    "let's start with the server address. this is the IP address or DNS that is the unique name on the internet of our `ec2` server\n",
    "\n",
    "head back over to [your aws instances dashboard](https://console.aws.amazon.com/ec2/v2/home) (*top menu* services > ec2 > *left menu* instances) and copy your *public DNS* or *public IP* to your clipboard for use as the `[server address]` in that command above."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "by default, the `[user name]` for logging in to `ec2` instances depends on the `ami` we chose\n",
    "\n",
    "+ `ubuntu` for aws ubuntu instances\n",
    "+ `ec2-user` for the aws linux instances\n",
    "\n",
    "in our first lecture we built `ubuntu` instances so our user name will be `ubuntu`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "as for that final part -- what we should send the remote server to authenticate -- that's slightly trickier, but it revolves around that special `.pem` file you downloaded when you created your `ec2` instance\n",
    "\n",
    "go find that file and get the full path to it (mac: secondary/control click then press `option` and select `copy ... as path`; windows `shift + right click > copy as path`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "armed with that, let's figure out what commands we can run on our laptops in order to use those three pieces of info (server name, user name, `ssh` private key file path) to connect to our `ec2` instance."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## `ssh` on macs, linux, and *newer* windows machines\n",
    "\n",
    "If you have a linux or mac laptop -- and increasingly often, a windows computer -- chances are it already has the `ssh` executable installed. open a terminal (`cmd + space > terminal` on mac, open a [terminal](https://docs.microsoft.com/en-us/windows/terminal/get-started) on windows ([second link](https://www.howtogeek.com/336775/how-to-enable-and-use-windows-10s-built-in-ssh-commands/))) and type\n",
    "\n",
    "```bash\n",
    "ssh\n",
    "```\n",
    "\n",
    "you should see an output like\n",
    "\n",
    "```\n",
    "usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface]\n",
    "           [-b bind_address] [-c cipher_spec] [-D [bind_address:]port]\n",
    "           [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11]\n",
    "           [-i identity_file] [-J [user@]host[:port]] [-L address]\n",
    "           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n",
    "           [-Q query_option] [-R address] [-S ctl_path] [-W host:port]\n",
    "           [-w local_tun[:remote_tun]] destination [command]\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "if you see nothing, try one of the options below, and feel free to drop in zoom for some help!\n",
    "\n",
    "1. mac: should be installed by default. don't try and do anything right now\n",
    "1. windows: wait and see how we install `putty`, or try installing `openssh` yourself: https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse\n",
    "1. linux: run `sudo apt install openssh-client`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "**<br><div align=\"center\">PAUSE FOR ZOOM QUESTION BREAK</div>**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "we will generally invoke the `ssh` command as\n",
    "\n",
    "```bash\n",
    "ssh [some collection of flags] [user name]@[server address]\n",
    "```\n",
    "\n",
    "the `[user name]` and `[server address]` pieces should be obvious from above -- but how do we use our `.pem` ssh key file, and what does `[some collection of flags]` mean?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "let's talk about `[flags]`. we will talk about these in some detail in the next `linux` lectures, but generally speaking, when we execute a command in `linux` we want to parameterize it (that is, tweak the way it executes for our particular use case).\n",
    "\n",
    "when we wrote `ssh` in our terminal, the output actually told us what parameters that command can take\n",
    "\n",
    "```ssh\n",
    "usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface]\n",
    "           [-b bind_address] [-c cipher_spec] [-D [bind_address:]port]\n",
    "           [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11]\n",
    "           [-i identity_file] [-J [user@]host[:port]] [-L address]\n",
    "           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n",
    "           [-Q query_option] [-R address] [-S ctl_path] [-W host:port]\n",
    "           [-w local_tun[:remote_tun]] destination [command]\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "so if I wanted to provide something called a `bind_interface`, I could write `ssh -B MY_BIND_INTERFACE_VALUE`.\n",
    "\n",
    "fortunately, we don't have to provide all of those parameters -- most of them have defaults (this is indicated by putting them in brackets, a la `[-B bind_interface]`), and almost all of the default values are what we want.\n",
    "\n",
    "we do know that we need to answer that final question though (*what should we send the remote server to authenticate*), and for the `ssh` command this is done by setting the value of the parameter `identity_file`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### sidebar: passing parameters to `linux` functions\n",
    "\n",
    "at a very high level (again, more detail in the next lecture), we can provide parameters to change how the `ssh` command executes in three ways\n",
    "\n",
    "1. command line flags (strings like \"`-*`\" or \"`--***`\", (where `*`s are some meaningful letters) that are typed right after the command itself)\n",
    "1. configuration files (files we save on our computer that the command knows to look for)\n",
    "1. environment variables (variables as in any other programming language, like `python` or `R`)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "let's look at how the first two categories affect the `ssh` command."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### `ssh` flags\n",
    "\n",
    "we already discussed these above, but we could provide our key file by writing it as we write and execute the `ssh` command:\n",
    "\n",
    "```bash\n",
    "ssh -i /path/to/my/private/key.pem user_name@remote_address\n",
    "```\n",
    "\n",
    "the `-i` tells the `ssh` command that what follows is the value of the `identity_file`, and what follows is a file path on our computer for an identity file (our `.pem` file)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### `ssh` configuration files\n",
    "\n",
    "imagine that I regularly have to sign in to an `ec2` server for work, and I find myself typing\n",
    "\n",
    "```bash\n",
    "ssh -i ~/.ssh/my_ec2_private_key my_ec2_username@ssh.storyblocks.com\n",
    "```\n",
    "\n",
    "multiple times a day. it would be nice if I could give these parameters a name and stop typing them so often..."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "this is basically what is done in the `.ssh` configuration file. because some smart developer wrote `ssh` to allow this, instead of writing those parameters every time we could instead update the file `~/.ssh/config` (where `~` is my \"home\" directory) to include a section:\n",
    "\n",
    "```\n",
    "Host work\n",
    "    HostName ssh.storyblocks.com\n",
    "    User my_ec2_username\n",
    "    IdentityFile ~/.ssh/my_ec2_private_key\n",
    "```\n",
    "\n",
    "and from then on I would only need to execute\n",
    "\n",
    "```bash\n",
    "ssh work\n",
    "```\n",
    "\n",
    "pretty cool"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### another sidebar: other `ssh`-related files\n",
    "\n",
    "There are four main files you should know about when using the `ssh` program. As is often the case with linux programs, the files that matter for the `ssh` command are kept in a folder called named for the command: `~/.ssh` (the `~` variable is your home directory, and the `.` makes the file \"hidden\").\n",
    "\n",
    "these files are:"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "+ `config` -- the file we just talked about above. this allows us create \"profiles\" (i.e. shortcut names) for the sets of parameters used to make connections to a given remote server"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "+ private keys (aka `identity_file`s)\n",
    "    + to make `ssh` connections we will use `ssh` keys. these files are large blocks of a bunch of random characters\n",
    "    + note that the `ssh` command will *always* try to provide an `identity_file`. if you don't specify one with `-i identity_file` on the command line or via a `IdentityFile` value in the `~/.ssh/config` file, it will look for a *default* value in the `~/.ssh/` directory.\n",
    "    + the default file will be assumed to have one of the names `id_dsa`, `id_ecdsa`, `id_ed25519`, or `id_rsa`, where the value `XXXX` in `id_XXXX` is the encryption algorithm\n",
    "\n",
    "here's an example of a private (rsa) key created using the `openssh` format:\n",
    "\n",
    "```\n",
    "-----BEGIN RSA PRIVATE KEY-----\n",
    "MIIEpAIBAAKCAQEAnD2SMDVMwQ+I7n1lDwS1c0EZDy0aCajGIB1Ex/u33Qr2BjDM\n",
    "flompsp3Bs3LDGaXElg2xpQhLqP/zU0nNgkktI3YLA4QRx2deJBzuQOc04a5jcNL\n",
    "/w/QB/wWhNQfJbPvogxNkpizBECAFQ+CH5nVn5AsGWkLaOoSG+F1FxA/yc/HVsxu\n",
    "KKTqX4DTA4mCt9cuaoYGUInWknVDTTsQaAj2nph1EaeUsAZvrG0500B+KM2vxT5H\n",
    "duBt0bofUxiKAQeRRrvkHM9bbhm5PvCMuqFplhWvmfl7U6VG7OVx46bXGyOcV1bD\n",
    "3YN+tLyvnawlpCRL3SARM0F8Bw4n/fOaF9+60wIDAQABAoIBADJlPckk+AvxydY7\n",
    "RiSQ/UIexkl538Mr2DQ1nKDw1X6L8Y1PojZDN+JmvfvI12y5jpMRNyHYV9emeHUt\n",
    "JK+uRVOjyQ10v9VgfRGNbnZH7wbfluxeCR5NaGma61yO2zkbD/lyBHd7n4qIj4e7\n",
    "h9pPkXM1WrQbiN2fWpX5o/37dMfQJ0zrVvDl5njG6rpMWWf+Jjyu2M1hKY3LXuFV\n",
    "Ps7YdEHgcDikoKqopBw5zPHz9uZtjxN3RQfUq832teI36mblG7utW1tToS7CqZRl\n",
    "dW4Y1PO3exBS526wEYjwRRMow35o2GFxYdtT6ksIc5N2HTa/jK75YPOQNwqCXk3k\n",
    "H53iMbkCgYEAzE3qFL0REeFJzGpClJlz5HziLEOOSVRkYRC02pdVbToLqf5NLe0D\n",
    "mcZWjwsWxjgu0ehuLyNL0UCTShhulZeJTTefk+t+UHfqaGZFo03T5qtR+GKn5QnK\n",
    "xkCvaM/KkoyxTBD8cE0Rc1bUIo7fS5MOiEyYNIFFd8Gtv7zfvN6WVw0CgYEAw8ZB\n",
    "8A6942JVELuDEtVCT0JEE9ahx1xCBOyIujp1IYfa8KDy5Aoef5DhpWVR1GT4j8l7\n",
    "Ccr60KI4k45GpIKwSTVgy/OpwcAEarzNIz67YbQzyYd9SLb5OUteAu61OnRO8R7d\n",
    "LL34juv9X5WqGWGSs2pJG3nQlO6dAnCLe9Uf4V8CgYA1W3PzDp3SqZ/4fxf8b0dR\n",
    "OTxoiwwyIpREtXRGUpfA+xPoxb2qbOgv1RjuKts70ZiIwcdlEDbQ46iUBWV8NCNr\n",
    "w0ct/qbypR7XPT6as8zPxZaW5E0tCC2pMWOeYAZr18rGLvl+6uHP2bF1hRLUTgfR\n",
    "mQ93Rvu5lx+ln9JfJVLmUQKBgQCA3oyg/NM6Tow4S3Zoe0D+81vkwzATD0PWAe2u\n",
    "yLQ5sjgIlanNOmwBBNnECgHnkd+cpr/7HkYj9+TOHKWbvPtV9XEWT/q6sy81I7rV\n",
    "LIIkOn6sdieeKfO8J0RnIcLiC5W7Wtm0jgiD7AwJU3d45aWvvJMLJxCKONfZt0PZ\n",
    "69zkeQKBgQCoT5Tam7cOZbSafJDG9HeXK3SfwQ5Q3zEg02OdXOy3yIhBRXzwsW8F\n",
    "NgQzxQ0/BYsuV2PFIcBoFLh+4Qo//hwI6dtFXy09FCXLGzH4k0dVq5gQ/l/Gg1vj\n",
    "27+/qHpwhJxffHVscgTi5LEXYt0+F+RhIUGN2F6pUuoxOao+SfaY+g==\n",
    "-----END RSA PRIVATE KEY-----\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "+ public keys\n",
    "    + `ssh` keys come in pairs: public and private. these files are the public portion of the above private key\n",
    "    + it may not exist, which is okay -- it can be generated from the private key\n",
    "\n",
    "here's an example of the public key corresponding to the above private key:\n",
    "\n",
    "```\n",
    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCcPZIwNUzBD4jufWUPBLVzQRkPLRoJqMYgHUTH+7fdCvYGMMx+WiamyncGzcsMZpcSWDbGlCEuo//NTSc2CSS0jdgsDhBHHZ14kHO5A5zThrmNw0v/D9AH/BaE1B8ls++iDE2SmLMEQIAVD4IfmdWfkCwZaQto6hIb4XUXED/Jz8dWzG4opOpfgNMDiYK31y5qhgZQidaSdUNNOxBoCPaemHURp5SwBm+sbTnTQH4oza/FPkd24G3Ruh9TGIoBB5FGu+Qcz1tuGbk+8Iy6oWmWFa+Z+XtTpUbs5XHjptcbI5xXVsPdg360vK+drCWkJEvdIBEzQXwHDif985oX37rT zlamberty@megaman\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "+ `authorized_keys`\n",
    "    + a file on the **server** which indicates which **public keys** are acceptable\n",
    "    + the remote server must already have your public key added to this file for you to be able to access the server as your user on that server\n",
    "    + aws installs your public key on your ec2 instance for you\n",
    "        + in the real world, on non-cloud machines you may have to work with sysads to get this done.\n",
    "\n",
    "the lines in `authorized_keys` will be formatted just like the public key strings shown on the previous slide"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### enough sidebars, back to `ssh` on `linux`\n",
    "\n",
    "after all that, we should be able to make a connection by executing\n",
    "\n",
    "```sh\n",
    "ssh -i /path/to/my/private/key.pem user_name@remote_address\n",
    "```\n",
    "\n",
    "or updating `~/.ssh/config` to include a block\n",
    "\n",
    "```\n",
    "Host gu511\n",
    "    HostName remote_address\n",
    "    User user_name\n",
    "    IdentityFile /path/to/my/private/key.pem\n",
    "```\n",
    "\n",
    "and running\n",
    "\n",
    "```sh\n",
    "ssh gu511\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "we will do that, right after we talk about Windows"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## `ssh` on the *other* windows"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "if you are using windows to make `ssh` connections, you should always check to see if you can do it using the `ssh` command from the previous section.\n",
    "\n",
    "**if you can't**, then the preferred `ssh` client program on windows is Simon Tatham's [PuTTY](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### private key file formats: `ppk` (windows) vs `openssh` (linux)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "the `putty` program is straight-forward except for one wrinkle. recall that we are always answering three questions when we make `ssh` connections:\n",
    "\n",
    "1. what is the address of the server to which you want to connect\n",
    "1. what is your name on that server\n",
    "1. what should we send the remote server to authenticate (a password or `ssh` key pair)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "the way that `putty` answers that 3rd question is a little different and requires we jump through a hoop: `aws` gave us our authentication details in a private key in a particular **file format** (`.pem`) -- the information is written in a way that the `ssh` command knows how to read\n",
    "\n",
    "`putty` has **it's own special format** that contains the exact same information but written in in a different way. this format is a lot more human readable but, importantly, *not* what `aws` wanted to give us. it is called the \"putty private key\" format (or `.ppk`)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "for example, the following two files contain the exact same information but written in slightly different ways (`openssh` format (like your `.pem`) on the left, `putty` private key (`.ppk`) on the right)\n",
    "\n",
    "<div align=\"center\"><img src=\"http://drive.google.com/uc?export=view&id=15ejnGT1_8Nd7tBwVtRSxTRbewixXXcSt\"></div>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "if you are a windows user who doesn't have `ssh` available (or just prefers a point-and-click option), go to that page (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html) and download the `MSI` installer (probably 64 bit).\n",
    "\n",
    "let's walk through the installation in a windows VM!"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "**<div align=\"center\">demo: installing and configuring PuTTY on Windows</div>**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "in an aws virtual server, let's do the following:\n",
    "\n",
    "1. launch the VM / server\n",
    "2. navigate to https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html\n",
    "3. follow the installation instructions\n",
    "4. use `puttygen` to create a `ppk` file\n",
    "5. discuss the differences between the `ppk` format and the `openssh` format\n",
    "6. show how we could use puttygen to convert\n",
    "    1. a `ppk` to `openssh`\n",
    "    2. an `openssh` to a `ppk`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### converting your `aws` `.pem` file to a `.ppk` you can use in `putty`\n",
    "\n",
    "the information `aws` gave you to connect to your `ec2` instance was in the `.pem` file format, and to make a connection you will need to convert that file to a `.ppk`. to do this:\n",
    "\n",
    "1. locate that `.pem` private key file on your laptop\n",
    "1. open `puttygen` (not `putty`, `puttygen`)\n",
    "1. load your `.pem` file into `puttygen` with \"Conversions > Import key\"\n",
    "1. click \"Save private key\" after importing"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "<div align=\"center\"><img src=\"http://drive.google.com/uc?export=view&id=1mpQawk4eSjN3MlmfZftvmIpPvPX9yrh2\"></div>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# connecting to your `ec2` instance"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "I really hope you saved your private and public keys somewhere!"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "*NOTE: if you are using campus wifi, you must connect to the `saxanet` wifi network. `guestnet` will not work*"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "from a terminal on a mac / linux / new windows:\n",
    "\n",
    "```bash\n",
    "ssh -i /path/to/my/aws_private_key.pem ubuntu@my.ec2.ip.addr\n",
    "```\n",
    "\n",
    "you may get an error message about the permissions on your `pem` keyfile being too open:\n",
    "\n",
    "```\n",
    "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n",
    "@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @\n",
    "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n",
    "Permissions 0644 for '/home/zlamberty/.ssh/gu511_ubuntu.pem' are too open.\n",
    "It is recommended that your private key files are NOT accessible by others.\n",
    "This private key will be ignored.\n",
    "key_load_private_type: bad permissions\n",
    "Permission denied (publickey).\n",
    "```\n",
    "\n",
    "if so, make a mental note of this, but then execute the following (we'll explain what we're doing here in a later lecture):\n",
    "\n",
    "```bash\n",
    "chmod 400 /path/to/my/aws_private_key.pem\n",
    "```\n",
    "\n",
    "and re-run the `ssh` command above"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "on old windows:\n",
    "\n",
    "1. open puttygen\n",
    "    1. Conversions > import key\n",
    "    2. navigate to aws private key (pem) and select / open\n",
    "    3. click \"save private key\"\n",
    "    4. make note of location (consider /user/myname/.ssh/, in analogy to linux)\n",
    "2. open putty\n",
    "    1. add the ip address or dns string\n",
    "    2. create a new name for an `ssh` profile\n",
    "    3. save this profile\n",
    "    4. go to \"Connection > Data\" and add your user name (ubuntu)\n",
    "    5. go to \"Connection > `ssh` > Auth\" and add the path to the private key file"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "**<div align=\"center\">I'M IN</div>**\n",
    "<div align=\"center\"><img src=\"http://drive.google.com/uc?export=view&id=0ByQ4VmO-MwEEYjVPY1ZoWWRnc0k\"></div>\n",
    "\n",
    "# END OF LECTURE\n",
    "\n",
    "next lecture: [a linux crash course](003_linux_1.ipynb)"
   ]
  }
 ],
 "metadata": {
  "celltoolbar": "Slideshow",
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.3"
  },
  "toc": {
   "base_numbering": 1,
   "nav_menu": {},
   "number_sections": true,
   "sideBar": true,
   "skip_h1_title": false,
   "title_cell": "Table of Contents",
   "title_sidebar": "Contents",
   "toc_cell": false,
   "toc_position": {},
   "toc_section_display": true,
   "toc_window_display": false
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}