{"id":1244,"date":"2011-01-26T11:00:20","date_gmt":"2011-01-26T10:00:20","guid":{"rendered":"http:\/\/t-machine.org\/?p=1244"},"modified":"2011-01-26T11:00:20","modified_gmt":"2011-01-26T10:00:20","slug":"safe-login-on-os-x-using-an-ssh-key-from-a-usb-keythumbdrive","status":"publish","type":"post","link":"http:\/\/new.t-machine.org\/index.php\/2011\/01\/26\/safe-login-on-os-x-using-an-ssh-key-from-a-usb-keythumbdrive\/","title":{"rendered":"Safe login on OS X: using an SSH key from a USB key\/thumbdrive"},"content":{"rendered":"

I like computer security to be EASY and SECURE.<\/p>\n

I hate passwords, and I use them rarely if at all. Instead, I use digital keys as much as possible (i.e. something based on a physical key stored on a removable USB drive that I take with me wherever I go). Like using a physical key, it’s much easier.<\/p>\n

Sadly, OS X has a version of SSH that tries to be “too clever” while actually being “annoyingly unhelpful”. If you attempt to use a key from a removable drive, you get this error message:<\/p>\n

\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
\n@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
\nPermissions 0777 for ‘login-key-for-tmachine.ssh’ are too open.
\nIt is recommended that your private key files are NOT accessible by others.
\nThis private key will be ignored.<\/strong><\/em>
\nbad permissions: ignore key: (key-name)
\nPermission denied (publickey).\n <\/p><\/blockquote>\n

(emphasis mine).<\/p>\n

While it’s delightfully verbose, and tells you exactly what’s happened, it’s also a bit misleading. It says “WARNING” when it actually means “ERROR”, since the ssh system at this point deliberately stops itself. But, more importantly, it’s an error that you cannot evade under OS X. With OS X, all removable media has “Permissions 0777”.<\/p>\n

Fortunately, there’s a workaround. Using this good but not-quite-detailed-enough article<\/a>, I got most of the way there.<\/p>\n

I had two problems, things that article omits.<\/p>\n

Firstly, you are no longer “allowed” to edit \/etc\/fstab on OS X. Don’t try it. Instead, there’s a new command-line editor called “vifs” (hmm. vi-for-fstab, perhaps? :)) which works fine.<\/p>\n

Secondly, the USB Drive I’m using has a space in the Label name. \/etc\/fstab uses spaces as a reserved character (I knew this), but … what do you write instead? (I didn’t know this).<\/p>\n

I tried (and failed with):<\/p>\n

    \n
  1. “My Drive”\n
  2. My\\ Drive\n
  3. My Drive\n<\/ol>\n

    …and with some creative googling, eventually found an example fstab with spaces in a label name. Aha!<\/p>\n

      \n
    1. My\\040Drive\n<\/ol>\n

      i.e. replace spaces with “\\040” (I’m guessing because it’s so low-level they’ve decided to “assume” unicode in all escape sequences)<\/p>\n

      …and now it all works as intended. Yay.<\/p>\n","protected":false},"excerpt":{"rendered":"

      I like computer security to be EASY and SECURE. I hate passwords, and I use them rarely if at all. Instead, I use digital keys as much as possible (i.e. something based on a physical key stored on a removable USB drive that I take with me wherever I go). Like using a physical key, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,45],"tags":[],"_links":{"self":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts\/1244"}],"collection":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/comments?post=1244"}],"version-history":[{"count":0,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts\/1244\/revisions"}],"wp:attachment":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/media?parent=1244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/categories?post=1244"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/tags?post=1244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}