[{"data":1,"prerenderedAt":433},["ShallowReactive",2],{"post-how-to-configure-ssh-key-based-authentication":3,"rel-how-to-configure-ssh-key-based-authentication":351,"sib-how-to-configure-ssh-key-based-authentication":352},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"layout":11,"subtitle":9,"image":12,"optimized_image":12,"category":13,"tags":14,"author":16,"paginate":6,"body":17,"_type":345,"_id":346,"_source":347,"_file":348,"_stem":349,"_extension":350},"/posts/how-to-configure-ssh-key-based-authentication","posts",false,"","How To Configure SSH Key-Based Authentication","Secure your ssh server by restricting authentication to ssh-keys","2021-02-21 03:46:12","post","/assets/img/uploads/ssh-keys.jpg","blog",[15],"unix","jaimedearcos",{"type":18,"children":19,"toc":336},"root",[20,32,39,104,112,117,144,150,155,185,198,203,209,222,230,235,260,275,287,330],{"type":21,"tag":22,"props":23,"children":24},"element","blockquote",{},[25],{"type":21,"tag":26,"props":27,"children":28},"p",{},[29],{"type":30,"value":31},"text","Recently I had to set-up a local server for some side projects I'm working at. I had configured ssh server to remote access, but I was afraid about the security risks of having external access to my home network with password login so I restricted the authentication to only ssh keys.",{"type":21,"tag":33,"props":34,"children":36},"h2",{"id":35},"_1-generate-ssh-keys",[37],{"type":30,"value":38},"1. Generate ssh keys",{"type":21,"tag":40,"props":41,"children":45},"pre",{"code":42,"language":43,"meta":7,"className":44,"style":7},"ssh-keygen -t rsa -b 4096 -f ~/.ssh/my-server.key -C \"My server key\"\n","bash","language-bash shiki shiki-themes github-dark github-light",[46],{"type":21,"tag":47,"props":48,"children":49},"code",{"__ignoreMap":7},[50],{"type":21,"tag":51,"props":52,"children":55},"span",{"class":53,"line":54},"line",1,[56,62,68,74,79,84,89,94,99],{"type":21,"tag":51,"props":57,"children":59},{"style":58},"--shiki-default:#B392F0;--shiki-light:#6F42C1",[60],{"type":30,"value":61},"ssh-keygen",{"type":21,"tag":51,"props":63,"children":65},{"style":64},"--shiki-default:#79B8FF;--shiki-light:#005CC5",[66],{"type":30,"value":67}," -t",{"type":21,"tag":51,"props":69,"children":71},{"style":70},"--shiki-default:#9ECBFF;--shiki-light:#032F62",[72],{"type":30,"value":73}," rsa",{"type":21,"tag":51,"props":75,"children":76},{"style":64},[77],{"type":30,"value":78}," -b",{"type":21,"tag":51,"props":80,"children":81},{"style":64},[82],{"type":30,"value":83}," 4096",{"type":21,"tag":51,"props":85,"children":86},{"style":64},[87],{"type":30,"value":88}," -f",{"type":21,"tag":51,"props":90,"children":91},{"style":70},[92],{"type":30,"value":93}," ~/.ssh/my-server.key",{"type":21,"tag":51,"props":95,"children":96},{"style":64},[97],{"type":30,"value":98}," -C",{"type":21,"tag":51,"props":100,"children":101},{"style":70},[102],{"type":30,"value":103}," \"My server key\"\n",{"type":21,"tag":22,"props":105,"children":106},{},[107],{"type":21,"tag":26,"props":108,"children":109},{},[110],{"type":30,"value":111},"Is strongly recommeded to use also a strong passphrase to avoid brute force attacks",{"type":21,"tag":26,"props":113,"children":114},{},[115],{"type":30,"value":116},"This command will generate 2 files with 4096 bits RSA key with a comment:",{"type":21,"tag":118,"props":119,"children":120},"ul",{},[121,133],{"type":21,"tag":122,"props":123,"children":124},"li",{},[125,131],{"type":21,"tag":47,"props":126,"children":128},{"className":127},[],[129],{"type":30,"value":130},"~/.ssh/my-server.key",{"type":30,"value":132}," – private key.",{"type":21,"tag":122,"props":134,"children":135},{},[136,142],{"type":21,"tag":47,"props":137,"children":139},{"className":138},[],[140],{"type":30,"value":141},"~/.ssh/my-server.key.pub",{"type":30,"value":143}," – public key.",{"type":21,"tag":33,"props":145,"children":147},{"id":146},"_2copy-public-key-in-the-server",[148],{"type":30,"value":149},"2.Copy public key in the server",{"type":21,"tag":26,"props":151,"children":152},{},[153],{"type":30,"value":154},"Just execute:",{"type":21,"tag":40,"props":156,"children":158},{"code":157,"language":43,"meta":7,"className":44,"style":7},"ssh-copy-id -i ~/.ssh/my-server.key.pub your-user@my.server.com\n",[159],{"type":21,"tag":47,"props":160,"children":161},{"__ignoreMap":7},[162],{"type":21,"tag":51,"props":163,"children":164},{"class":53,"line":54},[165,170,175,180],{"type":21,"tag":51,"props":166,"children":167},{"style":58},[168],{"type":30,"value":169},"ssh-copy-id",{"type":21,"tag":51,"props":171,"children":172},{"style":64},[173],{"type":30,"value":174}," -i",{"type":21,"tag":51,"props":176,"children":177},{"style":70},[178],{"type":30,"value":179}," ~/.ssh/my-server.key.pub",{"type":21,"tag":51,"props":181,"children":182},{"style":70},[183],{"type":30,"value":184}," your-user@my.server.com\n",{"type":21,"tag":26,"props":186,"children":187},{},[188,190,196],{"type":30,"value":189},"This is the same as  copy the public key file to ",{"type":21,"tag":47,"props":191,"children":193},{"className":192},[],[194],{"type":30,"value":195},"~/.ssh/authorized_keys",{"type":30,"value":197}," directory of the server",{"type":21,"tag":26,"props":199,"children":200},{},[201],{"type":30,"value":202},"Now you should be able to log in your server without the password",{"type":21,"tag":33,"props":204,"children":206},{"id":205},"_3-disable-password-login-on-the-server",[207],{"type":30,"value":208},"3. Disable password login on the server",{"type":21,"tag":26,"props":210,"children":211},{},[212,214,220],{"type":30,"value":213},"Just edit the file ",{"type":21,"tag":47,"props":215,"children":217},{"className":216},[],[218],{"type":30,"value":219},"/etc/ssh/sshd_config",{"type":30,"value":221}," (in server), search for the following fields and set to no",{"type":21,"tag":40,"props":223,"children":225},{"code":224},"PermitRootLogin no \nChallengeResponseAuthentication no\nPasswordAuthentication no\nUsePAM no\n",[226],{"type":21,"tag":47,"props":227,"children":228},{"__ignoreMap":7},[229],{"type":30,"value":224},{"type":21,"tag":26,"props":231,"children":232},{},[233],{"type":30,"value":234},"Restart the sshd server with:",{"type":21,"tag":40,"props":236,"children":238},{"code":237,"language":43,"meta":7,"className":44,"style":7},"sudo /etc/init.d/ssh reload\n",[239],{"type":21,"tag":47,"props":240,"children":241},{"__ignoreMap":7},[242],{"type":21,"tag":51,"props":243,"children":244},{"class":53,"line":54},[245,250,255],{"type":21,"tag":51,"props":246,"children":247},{"style":58},[248],{"type":30,"value":249},"sudo",{"type":21,"tag":51,"props":251,"children":252},{"style":70},[253],{"type":30,"value":254}," /etc/init.d/ssh",{"type":21,"tag":51,"props":256,"children":257},{"style":70},[258],{"type":30,"value":259}," reload\n",{"type":21,"tag":261,"props":262,"children":264},"h3",{"id":263},"_4-correct-ssh-directory-permissions",[265,267,273],{"type":30,"value":266},"4. Correct  ",{"type":21,"tag":47,"props":268,"children":270},{"className":269},[],[271],{"type":30,"value":272},".ssh",{"type":30,"value":274},"  directory  permissions",{"type":21,"tag":26,"props":276,"children":277},{},[278,280,285],{"type":30,"value":279},"Another security step for your ssh server is setting the right/minimum permissions in the ",{"type":21,"tag":47,"props":281,"children":283},{"className":282},[],[284],{"type":30,"value":272},{"type":30,"value":286}," folder.",{"type":21,"tag":40,"props":288,"children":290},{"code":289,"language":43,"meta":7,"className":44,"style":7},"chmod 700 ~/.ssh\nchmod 600 ~/.ssh/authorized_keys\n",[291],{"type":21,"tag":47,"props":292,"children":293},{"__ignoreMap":7},[294,312],{"type":21,"tag":51,"props":295,"children":296},{"class":53,"line":54},[297,302,307],{"type":21,"tag":51,"props":298,"children":299},{"style":58},[300],{"type":30,"value":301},"chmod",{"type":21,"tag":51,"props":303,"children":304},{"style":64},[305],{"type":30,"value":306}," 700",{"type":21,"tag":51,"props":308,"children":309},{"style":70},[310],{"type":30,"value":311}," ~/.ssh\n",{"type":21,"tag":51,"props":313,"children":315},{"class":53,"line":314},2,[316,320,325],{"type":21,"tag":51,"props":317,"children":318},{"style":58},[319],{"type":30,"value":301},{"type":21,"tag":51,"props":321,"children":322},{"style":64},[323],{"type":30,"value":324}," 600",{"type":21,"tag":51,"props":326,"children":327},{"style":70},[328],{"type":30,"value":329}," ~/.ssh/authorized_keys\n",{"type":21,"tag":331,"props":332,"children":333},"style",{},[334],{"type":30,"value":335},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":7,"searchDepth":314,"depth":314,"links":337},[338,339,340],{"id":35,"depth":314,"text":38},{"id":146,"depth":314,"text":149},{"id":205,"depth":314,"text":208,"children":341},[342],{"id":263,"depth":343,"text":344},3,"4. Correct  .ssh  directory  permissions","markdown","content:posts:how-to-configure-ssh-key-based-authentication.md","content","posts/how-to-configure-ssh-key-based-authentication.md","posts/how-to-configure-ssh-key-based-authentication","md",[],[353,357,361,365,369,373,377,381,385,389,393,397,401,405,409,413,414,418,421,425,429],{"_path":354,"title":355,"date":356},"/posts/gpt-sql-integration","Implementa un analizador de consultas en lenguaje natural para bases de datos SQL con GPT","2025-01-15T11:00:00.000Z",{"_path":358,"title":359,"date":360},"/posts/java-security-best-practices","Java Security Best Practices: Preventing Vulnerabilities and Threats","2024-08-15T11:00:00.000Z",{"_path":362,"title":363,"date":364},"/posts/circuit-breaking-resilience","Circuit Breaking in Distributed Systems","2024-07-15T11:00:00.000Z",{"_path":366,"title":367,"date":368},"/posts/maven-and-github-actions","Automating Java Builds with Maven and GitHub Actions CI/CD","2024-06-15T11:00:00.000Z",{"_path":370,"title":371,"date":372},"/posts/pattern-matching-sealed-classes-java21","A Guide to Pattern Matching and Sealed Classes in Java 21","2024-05-15T11:00:00.000Z",{"_path":374,"title":375,"date":376},"/posts/async-java-completable-vs-reactive","Asynchronous Programming in Java: CompletableFuture vs Reactive Streams","2024-04-15T11:00:00.000Z",{"_path":378,"title":379,"date":380},"/posts/mastering-concurrency","Mastering Concurrency in Java: Threads, Executors, and Virtual Threads","2024-03-15T11:00:00.000Z",{"_path":382,"title":383,"date":384},"/posts/microservices-mistakes","Common Mistakes When Developing Microservices","2024-02-15T11:00:00.000Z",{"_path":386,"title":387,"date":388},"/posts/tdd-testing","Test-Driven Development (TDD) in Java with JUnit and Mockito","2024-01-15T11:00:00.000Z",{"_path":390,"title":391,"date":392},"/posts/single-table-design","Single Table Design","2023-12-27T11:00:00.000Z",{"_path":394,"title":395,"date":396},"/posts/java-17","Exploring Java 17's New Features","2023-10-08T11:00:00.000Z",{"_path":398,"title":399,"date":400},"/posts/hexagonal-architecture","Introduction to Hexagonal Architecture","2023-10-02 18:00:00",{"_path":402,"title":403,"date":404},"/posts/terraform","Unleashing the Power of Infrastructure as Code (IaC)","2023-09-24 18:00:00",{"_path":406,"title":407,"date":408},"/posts/python-virtual-environments","Python Virtual Environments (venv)","2023-09-17 22:00:00",{"_path":410,"title":411,"date":412},"/posts/api-first-principles","API First principles","2023-09-01 22:15:18",{"_path":4,"title":8,"date":10},{"_path":415,"title":416,"date":417},"/posts/algorithms-binary-search-tree","Algorithms - Binary Search Tree in kotlin","2020-12-06T11:00:00.000Z",{"_path":419,"title":420,"date":417},"/posts/how-to-create-a-twitter-bot","How to create a Twitter bot",{"_path":422,"title":423,"date":424},"/posts/manage-aws-infrastructure-with-terraform","Bootstrap complete Java application infrastructure in AWS with Terraform","2020-12-02T11:00:00.000Z",{"_path":426,"title":427,"date":428},"/posts/algorithms-working-with-trees","Algorithms - Binary tree traversals in kotlin","2020-11-24T11:00:00.000Z",{"_path":430,"title":431,"date":432},"/posts/playing-with-ocr-libraries","Playing with OCR libraries","2020-11-22T11:00:00.000Z",1790510066413]