Secure Git Commits Server: Setting up Private GPG Key SSH Logins
In today's world, security is paramount for any system that handles sensitive data. Git servers are no exception. This article will guide you through setting up a secure Git server by enabling SSH logins with private GPG keys. This will help ensure that only authorized users can access your servers, thus preventing unauthorized access and data breaches.
Prerequisites
Before we dive into the process of setting up private GPG key SSH logins, there are a few things you should have in place:
- A running Git server
- SSH access to the server
- A recent version of Git installed on the server
Generating a GPG Key Pair
The first step in setting up private GPG key SSH logins is to generate a new GPG key pair.
On your local machine, run the following command to generate a new GPG key:
gpg --gen-key
This will prompt you to select the key type, key size, and expiration date. For this setup, we recommend using the default settings, which are:
- Key type: RSA and RSA (default)
- Key size: 4096 bits (default)
- Expiration date: 0 = key does not expire
Press Enter to accept the default settings for each prompt. After you have made your selections, you will be asked to enter a user ID and email address. Make sure you use a valid email address, as this will be used to identify the key in Git.
Adding the Public Key to the Server
Once you have generated your GPG key pair, you will need to add the public key to the server. To do this, you will need to copy the key to the server's authorized_keys file. You can find the public key in the ~/.gnupg/pubring.kbx file.
Run the following command to copy the public key to the server:
scp ~/.gnupg/pubring.kbx.your_user_id@your_server:~/
Once the key has been copied to the server, you can add it to the authorized_keys file with the following command:
ssh your_user_id@your_server "mkdir -p ~/.ssh && cat ~/pubring.kbx | grep '^pub' | awk '{print $3}' | sed -e 's/^/openssh /' >> ~/.ssh/authorized_keys"
Configuring Git to Use the Private Key
With the public key added to the server, it's time to configure Git to use the private key on your local machine.
First, you will need to import the private key into your GPG keyring. To do this, run the following command:
gpg --import ~/.gnupg/secring.kbx
Next, you will need to tell Git to use the private key for signing commits. This is done in the Git config file. Run the following command to open the config file:
git config --global core.gpgprogram gpg2
Once you have added the private key to your keyring and told Git to use it, you should see your commits signed with your GPG key in the Git server's logs.
- Generating a GPG key pair on your local machine
- Adding the public key to the server's authorized_keys file
- Configuring Git on your local machine to use the private key for signing commits