[{"data":1,"prerenderedAt":352},["ShallowReactive",2],{"cat-blog":3},[4],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"date":11,"layout":12,"subtitle":10,"image":13,"optimized_image":13,"category":14,"tags":15,"author":17,"paginate":7,"body":18,"_type":346,"_id":347,"_source":348,"_file":349,"_stem":350,"_extension":351},"/posts/how-to-configure-ssh-key-based-authentication","posts",false,"","How To Configure SSH Key-Based Authentication","Secure your ssh server by restricting authentication to ssh-keys","2021-02-21 03:46:12","post","/assets/img/uploads/ssh-keys.jpg","blog",[16],"unix","jaimedearcos",{"type":19,"children":20,"toc":337},"root",[21,33,40,105,113,118,145,151,156,186,199,204,210,223,231,236,261,276,288,331],{"type":22,"tag":23,"props":24,"children":25},"element","blockquote",{},[26],{"type":22,"tag":27,"props":28,"children":29},"p",{},[30],{"type":31,"value":32},"text","Recently I had to set-up a local server for some side projects I'm working at. I had configured ssh server to remote access, but I was afraid about the security risks of having external access to my home network with password login so I restricted the authentication to only ssh keys.",{"type":22,"tag":34,"props":35,"children":37},"h2",{"id":36},"_1-generate-ssh-keys",[38],{"type":31,"value":39},"1. Generate ssh keys",{"type":22,"tag":41,"props":42,"children":46},"pre",{"code":43,"language":44,"meta":8,"className":45,"style":8},"ssh-keygen -t rsa -b 4096 -f ~/.ssh/my-server.key -C \"My server key\"\n","bash","language-bash shiki shiki-themes github-dark github-light",[47],{"type":22,"tag":48,"props":49,"children":50},"code",{"__ignoreMap":8},[51],{"type":22,"tag":52,"props":53,"children":56},"span",{"class":54,"line":55},"line",1,[57,63,69,75,80,85,90,95,100],{"type":22,"tag":52,"props":58,"children":60},{"style":59},"--shiki-default:#B392F0;--shiki-light:#6F42C1",[61],{"type":31,"value":62},"ssh-keygen",{"type":22,"tag":52,"props":64,"children":66},{"style":65},"--shiki-default:#79B8FF;--shiki-light:#005CC5",[67],{"type":31,"value":68}," -t",{"type":22,"tag":52,"props":70,"children":72},{"style":71},"--shiki-default:#9ECBFF;--shiki-light:#032F62",[73],{"type":31,"value":74}," rsa",{"type":22,"tag":52,"props":76,"children":77},{"style":65},[78],{"type":31,"value":79}," -b",{"type":22,"tag":52,"props":81,"children":82},{"style":65},[83],{"type":31,"value":84}," 4096",{"type":22,"tag":52,"props":86,"children":87},{"style":65},[88],{"type":31,"value":89}," -f",{"type":22,"tag":52,"props":91,"children":92},{"style":71},[93],{"type":31,"value":94}," ~/.ssh/my-server.key",{"type":22,"tag":52,"props":96,"children":97},{"style":65},[98],{"type":31,"value":99}," -C",{"type":22,"tag":52,"props":101,"children":102},{"style":71},[103],{"type":31,"value":104}," \"My server key\"\n",{"type":22,"tag":23,"props":106,"children":107},{},[108],{"type":22,"tag":27,"props":109,"children":110},{},[111],{"type":31,"value":112},"Is strongly recommeded to use also a strong passphrase to avoid brute force attacks",{"type":22,"tag":27,"props":114,"children":115},{},[116],{"type":31,"value":117},"This command will generate 2 files with 4096 bits RSA key with a comment:",{"type":22,"tag":119,"props":120,"children":121},"ul",{},[122,134],{"type":22,"tag":123,"props":124,"children":125},"li",{},[126,132],{"type":22,"tag":48,"props":127,"children":129},{"className":128},[],[130],{"type":31,"value":131},"~/.ssh/my-server.key",{"type":31,"value":133}," – private key.",{"type":22,"tag":123,"props":135,"children":136},{},[137,143],{"type":22,"tag":48,"props":138,"children":140},{"className":139},[],[141],{"type":31,"value":142},"~/.ssh/my-server.key.pub",{"type":31,"value":144}," – public key.",{"type":22,"tag":34,"props":146,"children":148},{"id":147},"_2copy-public-key-in-the-server",[149],{"type":31,"value":150},"2.Copy public key in the server",{"type":22,"tag":27,"props":152,"children":153},{},[154],{"type":31,"value":155},"Just execute:",{"type":22,"tag":41,"props":157,"children":159},{"code":158,"language":44,"meta":8,"className":45,"style":8},"ssh-copy-id -i ~/.ssh/my-server.key.pub your-user@my.server.com\n",[160],{"type":22,"tag":48,"props":161,"children":162},{"__ignoreMap":8},[163],{"type":22,"tag":52,"props":164,"children":165},{"class":54,"line":55},[166,171,176,181],{"type":22,"tag":52,"props":167,"children":168},{"style":59},[169],{"type":31,"value":170},"ssh-copy-id",{"type":22,"tag":52,"props":172,"children":173},{"style":65},[174],{"type":31,"value":175}," -i",{"type":22,"tag":52,"props":177,"children":178},{"style":71},[179],{"type":31,"value":180}," ~/.ssh/my-server.key.pub",{"type":22,"tag":52,"props":182,"children":183},{"style":71},[184],{"type":31,"value":185}," your-user@my.server.com\n",{"type":22,"tag":27,"props":187,"children":188},{},[189,191,197],{"type":31,"value":190},"This is the same as  copy the public key file to ",{"type":22,"tag":48,"props":192,"children":194},{"className":193},[],[195],{"type":31,"value":196},"~/.ssh/authorized_keys",{"type":31,"value":198}," directory of the server",{"type":22,"tag":27,"props":200,"children":201},{},[202],{"type":31,"value":203},"Now you should be able to log in your server without the password",{"type":22,"tag":34,"props":205,"children":207},{"id":206},"_3-disable-password-login-on-the-server",[208],{"type":31,"value":209},"3. Disable password login on the server",{"type":22,"tag":27,"props":211,"children":212},{},[213,215,221],{"type":31,"value":214},"Just edit the file ",{"type":22,"tag":48,"props":216,"children":218},{"className":217},[],[219],{"type":31,"value":220},"/etc/ssh/sshd_config",{"type":31,"value":222}," (in server), search for the following fields and set to no",{"type":22,"tag":41,"props":224,"children":226},{"code":225},"PermitRootLogin no \nChallengeResponseAuthentication no\nPasswordAuthentication no\nUsePAM no\n",[227],{"type":22,"tag":48,"props":228,"children":229},{"__ignoreMap":8},[230],{"type":31,"value":225},{"type":22,"tag":27,"props":232,"children":233},{},[234],{"type":31,"value":235},"Restart the sshd server with:",{"type":22,"tag":41,"props":237,"children":239},{"code":238,"language":44,"meta":8,"className":45,"style":8},"sudo /etc/init.d/ssh reload\n",[240],{"type":22,"tag":48,"props":241,"children":242},{"__ignoreMap":8},[243],{"type":22,"tag":52,"props":244,"children":245},{"class":54,"line":55},[246,251,256],{"type":22,"tag":52,"props":247,"children":248},{"style":59},[249],{"type":31,"value":250},"sudo",{"type":22,"tag":52,"props":252,"children":253},{"style":71},[254],{"type":31,"value":255}," /etc/init.d/ssh",{"type":22,"tag":52,"props":257,"children":258},{"style":71},[259],{"type":31,"value":260}," reload\n",{"type":22,"tag":262,"props":263,"children":265},"h3",{"id":264},"_4-correct-ssh-directory-permissions",[266,268,274],{"type":31,"value":267},"4. Correct  ",{"type":22,"tag":48,"props":269,"children":271},{"className":270},[],[272],{"type":31,"value":273},".ssh",{"type":31,"value":275},"  directory  permissions",{"type":22,"tag":27,"props":277,"children":278},{},[279,281,286],{"type":31,"value":280},"Another security step for your ssh server is setting the right/minimum permissions in the ",{"type":22,"tag":48,"props":282,"children":284},{"className":283},[],[285],{"type":31,"value":273},{"type":31,"value":287}," folder.",{"type":22,"tag":41,"props":289,"children":291},{"code":290,"language":44,"meta":8,"className":45,"style":8},"chmod 700 ~/.ssh\nchmod 600 ~/.ssh/authorized_keys\n",[292],{"type":22,"tag":48,"props":293,"children":294},{"__ignoreMap":8},[295,313],{"type":22,"tag":52,"props":296,"children":297},{"class":54,"line":55},[298,303,308],{"type":22,"tag":52,"props":299,"children":300},{"style":59},[301],{"type":31,"value":302},"chmod",{"type":22,"tag":52,"props":304,"children":305},{"style":65},[306],{"type":31,"value":307}," 700",{"type":22,"tag":52,"props":309,"children":310},{"style":71},[311],{"type":31,"value":312}," ~/.ssh\n",{"type":22,"tag":52,"props":314,"children":316},{"class":54,"line":315},2,[317,321,326],{"type":22,"tag":52,"props":318,"children":319},{"style":59},[320],{"type":31,"value":302},{"type":22,"tag":52,"props":322,"children":323},{"style":65},[324],{"type":31,"value":325}," 600",{"type":22,"tag":52,"props":327,"children":328},{"style":71},[329],{"type":31,"value":330}," ~/.ssh/authorized_keys\n",{"type":22,"tag":332,"props":333,"children":334},"style",{},[335],{"type":31,"value":336},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":8,"searchDepth":315,"depth":315,"links":338},[339,340,341],{"id":36,"depth":315,"text":39},{"id":147,"depth":315,"text":150},{"id":206,"depth":315,"text":209,"children":342},[343],{"id":264,"depth":344,"text":345},3,"4. Correct  .ssh  directory  permissions","markdown","content:posts:how-to-configure-ssh-key-based-authentication.md","content","posts/how-to-configure-ssh-key-based-authentication.md","posts/how-to-configure-ssh-key-based-authentication","md",1790510063183]