SSH Key management

Great development always happens under source‑control.

In fact many developers rightly argue that what happens outside source‑control management isn’t really development at all.

All projects Web Deli™ is engaged in are carried out under source control and by preference Git+ specifically. We also use the fantastic tools from time to time at github.com and more recently bitbucket.org (Atlassian) for hosted repositories.

The challenge that comes up as we work in dynamic teams and on different projects or at a client’s site office for a period of time is access management across different locations.

To solve this challenge -  project specific SSH keys are generated for each new project. This allows us to enable secure access to the repository for the duration of the project and allows for a division between project and post-project access management in a way that does not break or interfere access at other sites.

The following post demonstrates how to create a project specific key. We configure then key management on our development platform (Mac OS X). The following is one method, but certainly not the only approach.

First we want to create a new key for an example project for Nokia. Open Terminal and issue the following command:

ssh-keygen -b 4096 -C "This is the Nokia project key" -f nokia_project_rsa -N MySecretPassword -t rsa 

So what does this code do:

1. ‘ssh-keygen’ – This is the command used to create our new SSH project key. The rest of the sting are the options described below:
2. ‘-b’ – This option specifies our key-size in number of bits, because we all love a ridonculous level of security, the resulting key-size in our example is 4096 bits.
3. ‘-C’ – This option allows us to specify a comment for our generated key.
4. ‘-f’ – This option specifies the name of the files to be output.
5. ‘-N’ – This option specifies the passphrase for the private key
6. ‘-t’ – Finally this option specifies type of key to create: RSA in this example.

That should result in the following output:

Generating public/private rsa key pair.
Your identification has been saved in nokia_project_rsa.
Your public key has been saved in nokia_project_rsa.pub.
The key fingerprint is:
41:30:cf:a2:b0:f2:4e:01:47:79:6b:d1:7d:8c:95:f1 This is the Nokia project key
The key's randomart image is:
+--[ RSA 4096]----+
| .. .oo.+oo |
| .. o .=o +. |
|. o. o. +. E |
| o oo. . . |
|. o.. S |
| o . |
| o |
| o |
| . |
+-----------------+
webdeli:~ admin$

Now the public key found in the ~/.shh folder may be added to the access control on the git repository and used for the duration of the project.

Hidden Files? Hidden Files! We don't need no stinkn' hidden files.

It’s a new year, happy 2012 everyone. So late in December I updated to a dev system which is an iMac running OS X Lion. Given it’s the new year and work is not in full-swing till later this month (the bulk of our clients are running a skeletal staff until school returns next week) I thought this would be a good time to do some maintenance and non-development tasks that should be done to get ready for the year ahead.

One of the items on my @todo list was to update a public RSA key in use last year and in so doing I came across this issue. Down into the console I go to generate a new key:

cd ~/.ssh

generate the a new key

ssh-keygen -t rsa -C "projects@webdeli.com.au"

and bang – out comes a shiny, shiny new key at ‘Users/webdeli/.ssh/id_rsa.pub’

So far so good. Back to the desktop and navigating the browser to a public site the we authenticate to with PKI, go to admin, authorise a public key, open Finder, go to ‘Users/webdeli/.ssh/id_rsa.pub’ ..hey it’s not there, oh that’s right – new system, default settings I haven’t enabled ‘Show hidden files’ in the finder config yet.

Cool, I think… so I go to ‘Finder > Preferences’ … hmmm not here.. ah go to ‘Finder > Preferences > Advanced’ .. no luck here either.

Mac OS X (Lion) - Finder Preferences

Wow, I must be losing it… So I look at ‘Finder > View > Show View Options’ and still nothing..

Mac OS X (Lion) Finder > Show View Options

So what is going on here?

Well it turns out that a design decision in OS X Lion has been made that out here in user-land we don’t need no stinking hidden files. Yes this sucks. Yes you can fix it. No you won’t need to install a utility or software patch, but you will need to execute some console code:

To enable hidden files view in finder on Mac OS X (Lion) – In console:

 defaults write com.apple.Finder AppleShowAllFiles TRUE 

Voilà there are our hidden files (breathes a sigh of relief)

OS X (Lion) Finder Window - Showing Hidden Files

and later if you decide you want to turn this off,

To dis-able hidden files view in finder on Mac OS X (Lion) - In console:

 defaults write com.apple.Finder AppleShowAllFiles FALSE 

I don’t know, but I suspect this design decision is part of the trend from Cupertino toward the iOSification of alot of the OS X (Lion) os and the trend towards simplification and the lockdown of those devices creeping into the macbook/imac & pro’s operating system.

The team here at Web Deli™ have taken to using PhpStorm for a lot of our PHP IDE development and over the last moth we have been honing or processes to take full advantage of many of the in-built features. Everything has been going smoothly, and we couldn’t be happier with our current choice of IDE. But one feature (as at 3.0) did throw us for a few minutes. Integrating PhpStorm to our GitHub repository. After pulling up the configuration screen we were asked to provide our credential, all pretty standard fair:

Having carefully checked all the configuration setting before entering them, we should see all of our public and private GitHub repositories and any projects we are collaborators on, right? Well we though so too.. but unfortunately we got stuck at this point for a little will getting the the following “Cannot login to the github.com using given credentials” error message:

But how can this be right? We checked and tested the credentials with our Git+ client (Tower) and connected to the GitHub account without a hitch.. So what’s up with PhpStorm? As it turns out the answer (although not document as at the time of writing this) is pretty straight forward, with a bit of guess work, we discovered that rather that using our email, we replaced this with out GitHub nickname:

and hold our breath… 3.. 2.. 1

Woot! Now on with the show.

Installing Android SDK

As an exercise in adventures in programming this weekend, we are firing up the Android SKD to take a first look at App Development for Android devices (Phones, Tablets). Another project already has a clearly identified iOS (Apple iPhone/iPad) project component, and we are currently awaiting communication, confirmation and enrollment from the Apple Inc side to be granted full access to that platform. In the interim 2 things emerged:

1. An idea for a new service that could become it’s own start-up venture
2. The desire to run and test our peer’s Android applications in a Desktop VM as the HTC we have in the office is too busy in use as a phone, to be shared around as a application testing rig.

No doubt other developers would be seeing the trot becoming a canter from desktop access of the net to mobile access is more than a trend and any of us that have used mobile internet browsers will know, some tasks are better served by an native application or ‘app’.

At this office we feel that it is critical to our vision that we are capable in this space moving forward.

<?php

// Welcome to the WebDeli Blog
echo 'Hello World.';

?>