A review of two available methods
You can:
A. Generate a new set of cryptographic keys (Recommended)
B. Copy the cryptographic keys from the machine where it's been activated in the past (Not recommended)
To generate a new set of cryptographic keys, there are three main steps. They occur from two different machines, so pay careful attention to which machine you perform each step on.
"Old machine" is the machine that has the original set of cryptographic keys that were generated. "New machine" is the device you want the new set of cryptographic keys on. These new keys will have restricted permissions that only work with NoPorts, and cannot be used for generating other keys.
[Old machine] Generate a Passcode
[New machine] Enroll the new key pair (send a request for keys from the new machine)
[Old machine] Approve the request
For detailed instructions, follow this guide:
The atSign keys file will be located at ~/.atsign/keys/ directory with a filename that will include the atSign. Copy this file from your other machine to the same location on the machine that you are installing SSH No Ports on, using scp or similar.
Why don't we recommend this approach?
When you use method A, it creates a new set of cryptographic keys. These keys can be disabled individually, which means if a device's keys are compromised, you can disable those keys without affecting your other devices.
"Old machine" is the machine that has the original set of cryptographic keys that were generated. "New machine" is the device you want the new set of cryptographic keys on.
Choose the operating system that is running on your old machine.
Make sure to replace <REPLACE_client> with your client atSign
Choose the operating system that is running on your new machine.
Make sure to replace the appropriate values:
<REPLACE_client> with your client atSign
<client_device_name> with a unique name for the device
<PASSCODE> with the passcode from Step 1
Choose the operating system that is running on your old machine.
Make sure to replace <client_device_name> with the device name from Step 2
If the request looks incorrect, then press "Deny" to deny it, and start the process again.
If the request looks correct, then press "Approve" to approve it.
~/.local/bin/at_activate otp -a @<REPLACE_client>~/.local/bin/at_activate enroll -a @<REPLACE_client> \
-s <PASSCODE> \
-p noports \
-k ~/.atsign/keys/@<REPLACE_client>_key.atKeys \
-d <client_device_name> \
-n "sshnp:rw,sshrvd:rw"~/.local/bin/at_activate approve -a @<REPLACE_client> \
--arx noports \
--drx <client_device_name>
