How to setup PasswordLess SSH in Linux?

This tutorial answers your question i.e. How to setup Passwordless SSH?

SSH  is a protocol to communicate a server with the client in an encrypted manner. It has replaced telnet protocol, which was not at all secure at all. Almost all the Linux system admins know about it because they use it to connect to Linux servers as the physical access to the server is very limited.

SSH is installed by default on most Linux distribution. & to access a server through ssh is very easy, you use the following command

$ ssh {Server IP address or FQDN}

and then you enter the credentials. But in this tutorial, we will learn to access ssh session securely with the help of Public/Private keys authentication aka passwordless ssh setup. Advantages of using Public/Private keys authentication are

• You won’t be asked for a password every time you access the server (unless you are using a passphrase to decrypt the keys)
• No-one can gain unauthorized access to your server unless they have the right key.

Now let’s create Public/Private keys for passwordless ssh setup to access our servers.

Setup PasswordLess SSH

Creating keys on the Local machine

Remember this, keys are to be created on each host that you wish to gain access from. So if there are 10-20 hosts from where you want to access a server, we must create keys on all those 10-20 servers.

To create keys, run the following command

$ ssh-keygen –t rsa

It will then ask you to select a location for the generated keys. By default, the keys will be stored in the ~/.ssh which is a hidden directory in your home folder (/home/dan/.ssh). The private key will be called id_rsa and the associated public key will be called id_rsa.pub.

It will also ask you to enter a passphrase, which is used to decrypt the keys. If you don’t wish to use any pass-phrase just leave it empty & press enter or else provide a pass-phrase.

Next, set permissions on your private keys,

$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/id_rsa

---

Configuration on Remote Server

Now copy the Public key (id_rsa.pub) & move it to the remote server at /home/user/.ssh/authorized_keys folder. Now that the public keys have imported to server, remove them from local machine.

Next, we will also have to set permissions on the server as well

$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/authorized_keys

All the settings for Public/Private keys authentication are now complete.

---

Testing the Public/Private keys authentication  

Now log back into the local machine to access the server & enter

$ ssh {Server IP address or FQDN}

& hit enter. You will notice that you won’t be asked for the credentials & are logged directly into the server.

Once you have tested your passwordless ssh setup, you can also disable the use of password authentication so that everyone uses only keys to access the server. Thus making your servers more secure. To disable password authentication , open /etc/sshd/sshd_config & change the following parameter

PasswordAuthentication no

That’s it, this completes our tutorial on how to setup PasswordLess SSH on Linux machines. 

[Quick Tips: Chage]: Password Expiration and Aging

Examples to Manage Linux Password Expiration and Aging Using chage

NAME

chage change user password expiry information

SYNOPSIS

chage [options] [LOGIN] 

DESCRIPTION

The chage command changes the number of days between password changes and the date of the last password change. This information is used by the system to determine when a user must change his/her password.

OPTIONS

TAG	DESCRIPTION
-d, --lastday LAST_DAY	Set the number of days since January 1st, 1970 when the password was last changed. The date may also be expressed in the format YYYY-MM-DD (or the format more commonly used in your area).
-E, --expiredate EXPIRE_DATE	Set the date or number of days since January 1, 1970 on which the user's account will no longer be accessible. The date may also be expressed in the format YYYY-MM-DD (or the format more commonly used in your area). A user whose account is locked must contact the system administrator before being able to use the system again.Passing the number -1 as the EXPIRE_DATE will remove an account expiration date.
-h, --help	Display help message and exit.
-I, --inactive INACTIVE	Set the number of days of inactivity after a password has expired before the account is locked. The INACTIVE option is the number of days of inactivity. A user whose account is locked must contact the system administrator before being able to use the system again. Passing the number -1 as the INACTIVE will remove an account's inactivity.
-l, --list	Show account aging information.
-m, --mindays MIN_DAYS	Set the minimum number of days between password changes to MIN_DAYS. A value of zero for this field indicates that the user may change his/her password at any time.
-M, --maxdays MAX_DAYS	Set the maximum number of days during which a password is valid. When MAX_DAYS plus LAST_DAY is less than the current day, the user will be required to change his/her password before being able to use his/her account. This occurrence can be planned for in advance by use of the -W option, which provides the user with advance warning.Passing the number -1 as MAX_DAYS will remove checking a password's validity.
-W, --warndays WARN_DAYS	Set the number of days of warning before a password change is required. The WARN_DAYS option is the number of days prior to the password expiring that a user will be warned his/her password is about to expire.

EXAMPLES

EXAMPLE-1:
Use chage command to list the password aging information of a user

$ chage -l testuser

output:

Last password change : May 01, 2016
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 15

EXAMPLE-2:
Disable password aging for a user

$ chage -I -1 -m 0 -M 99999 -E -1 testuser

-I -1 : This will set the “Password inactive” to never
-m 0 : This will set the minimum number of days between password change to 0
-M 99999 : This will set the maximum number of days between password change to 99999
-E -1 : This will set “Account expires” to never.
This will disable the password expiry of a user if it is already enabled.

EXAMPLE-3:
Enable password expiry date of a user

$ chage -M 20 testuser

Output
Last password change : May 01, 2016
Password expires : May 21, 2017
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 20
Number of days of warning before password expires : 15

EXAMPLE-4:
Set the Account expiry date in the format YYYY-MM-DD

$ chage -E 2017-05-28

output:
Last password change : May 01, 2016
Password expires : May 28, 2017
Password inactive : never
Account expires : May 28, 2012
Minimum number of days between password change : 0
Maximum number of days between password change : 20
Number of days of warning before password expires : 15

EXAMPLE-5:
Set the password expiry warning message

$ chage -W 10 testuser

User will start getting warning about the password expiry which is set to 10 days.

EXAMPLE-6:
Forcing the users to change the password on next logon

$ chage -d 0 testuser

This will reset “Last Password Change” to “Password must be changed”.

In this article let us review how you can use Linux chage command to perform several practical password aging activities including how-to force users to change their password.

On debian, you can install chage by executing the following command:
# apt-get install chage

 
Note: It is very easy to make a typo on this command. Instead of chage you may end up typing it as change. Please remember chage stands for “change age”. i.e chage command abbreviation is similar to chmod, chown etc.,

1. List the password and its related details for an user

As shown below, any user can execute the chage command for himself to identify when his password is about to expire.
Syntax: chage –-list username (or) chage -l username

$ chage --list dhinesh
Last password change                                    : Apr 01, 2009
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7

 
If user dhinesh tries to execute the same command for user ramesh, he’ll get the following permission denied message.
$ chage --list ramesh
chage: permission denied

 
Note: However, a root user can execute chage command for any user account.
 
When user dhinesh changes his password on Apr 23rd 2009, it will update the “Last password change” value as shown below.
 
Please refer to our earlier article: Best Practices and Ultimate Guide For Creating Super Strong Password, which will help you to follow the best practices while changing password for your account.
$ date
Thu Apr 23 00:15:20 PDT 2009

$ passwd dhinesh
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

$ chage --list dhinesh
Last password change                                    : Apr 23, 2009
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7

2. Set Password Expiry Date for an user using chage option -M

Root user (system administrators) can set the password expiry date for any user. In the following example, user dhinesh password is set to expire 10 days from the last password change.
 
Please note that option -M will update both “Password expires” and “Maximum number of days between password change” entries as shown below.
Syntax: # chage -M number-of-days username

# chage -M 10 dhinesh

# chage --list dhinesh
Last password change                                    : Apr 23, 2009
Password expires                                        : May 03, 2009
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 10
Number of days of warning before password expires       : 7

3. Password Expiry Warning message during login

By default the number of days of warning before password expires is set to 7. So, in the above example, when the user dhinesh tries to login on Apr 30, 2009 — he’ll get the following message.
$ ssh dhinesh@testingserver
dhinesh@testingserver's password:
Warning: your password will expire in 3 days

4. User Forced to Change Password after Expiry Date

If the password expiry date reaches and user doesn’t change their password, the system will force the user to change the password before the login as shown below.
$ ssh dhinesh@testingserver
dhinesh@testingserver's password:

You are required to change your password immediately (password aged)
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for dhinesh
(current) UNIX password:
Enter new UNIX password:
Retype new UNIX password:

5. Set the Account Expiry Date for an User

You can also use chage command to set the account expiry date as shown below using option -E. The date given below is in “YYYY-MM-DD” format. This will update the “Account expires” value as shown below.
# chage -E "2009-05-31" dhinesh

# chage -l dhinesh
Last password change                                    : Apr 23, 2009
Password expires                                        : May 03, 2009
Password inactive                                       : never
Account expires                                         : May 31, 2009
Minimum number of days between password change          : 0
Maximum number of days between password change          : 10
Number of days of warning before password expires       : 7

6. Force the user account to be locked after X number of inactivity days

Typically if the password is expired, users are forced to change it during their next login. You can also set an additional condition, where after the password is expired, if the user never tried to login for 10 days, you can automatically lock their account using option -I as shown below. In this example, the “Password inactive” date is set to 10 days from the “Password expires” value.
 
Once an account is locked, only system administrators will be able to unlock it.
# chage -I 10 dhinesh

# chage -l dhinesh
Last password change                                    : Apr 23, 2009
Password expires                                        : May 03, 2009
Password inactive                                       : May 13, 2009
Account expires                                         : May 31, 2009
Minimum number of days between password change          : 0
Maximum number of days between password change          : 10
Number of days of warning before password expires       : 7

7. How to disable password aging for an user account

To turn off the password expiration for an user account, set the following:

-m 0 will set the minimum number of days between password change to 0
-M 99999 will set the maximum number of days between password change to 99999
-I -1 (number minus one) will set the “Password inactive” to never
-E -1 (number minus one) will set “Account expires” to never.

# chage -m 0 -M 99999 -I -1 -E -1 dhinesh

# chage --list dhinesh
Last password change                                    : Apr 23, 2009
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7

[Quick Tips: Password Complexities]: How To Check The Password Complexity In Linux

How To Check The Password Complexity In Linux

Now, how do we know if the generated password is strong? Good question, isn’t it? Indeed! This brief guide has the answer for you. Before going further, here is my suggestion to all those who wants to keep your system safe.

• Never ever use the same password for different Email accounts, ssh/ftp/sftp logins. If a hacker managed to crack your password, he literally have access to all accounts. So, generate and use different unique password to each account.
• A good password should be combination of letters, numbers, special characters.
• Make sure your password has at least 12 or more characters. Check our guide how to force users to use strong password.
• Don’t save your passwords online. Use good password manager or memorize them.
• Consider two factor authentication if possible.
• More importantly, Don’t use valid answers for security questions, eventually with enough data breaches, hackers will have all the answers. The common security questions are father’s maiden name, school name, favorite pet’s name, last name of first girlfriend/boyfriend, etc. Since much of the time these are stored in plain text on websites someone can gain access to many of your accounts by knowing these answers. Instead, put in mixed letters/numbers as answers and use a secure password manager to keep track of your answers. I came across this tip on Reddit. So I thought sharing it here would be helpful to someone.

Now, let us get into the topic. In this short tutorial, we will see how to check the password complexity in Linux from commandline.

Check The Password Complexity In Linux

There are plenty of tools and websites are available to test the password complexity. But, what we are going to discuss here is the easiest and effective method among them.

Install cracklib package if it is not installed already.

On Arch Linux and its derivatives, run:

sudo pacman -S cracklib

On RHEL, Fedora, CentOS:

sudo yum install cracklib

Or,

sudo dnf install cracklib

On Debian, Ubuntu, Linux Mint:

sudo apt-get install libcrack2

Now, It is time for some password complexity tests.

Let us start with a simple password.

echo "Welcome1" | cracklib-check

Sample output:

Welcome1: it is based on a dictionary word.

As you see in the above output, the given password is based on dictionary word, which is not recommended.

Let us see what will be the result if give a strong password.

echo "wXCHXlxuhrFrFMQLqik=9" | cracklib-check

Sample output:

wXCHXlxuhrFrFMQLqik=9: OK

Here is another one.

echo "sheew3aeReidir&*=" | cracklib-check

Sample output:

sheew3aeReidir&*=: OK

Great! These password are strong enough to use. Likewise, You can check the complexity of different passwords as described above.

[Quick Tips: Root Password]: Reset Your Forgotten Root Password On RHEL 7

Reset Your Forgotten Root Password On RHEL 7

Sometimes you forget stuff like meetings, seminars,passwords etc. I do. But forgetting a password to a Servers with no easy way to reset it while locked outRedhat servers is one of such systems. If you forget the root password to your RHEL 7 SERVERS, it’s almost virtually impossible to reset it while you’re locked out.

Here i Discuss an easy way to reset password in RHEL 7 servers or  Centos 7

Interrupt the boot process in order to gain access to a system.for this press the arrow keys in keyboard

At the boot menu, press e to edit the existing kernel . Then, go to the kernel line (the line starting with linux16) .

Then add the statement rd.break at the end as shown below:

Then press Ctrl-x to start the boot process

Then mount the /sysroot/ in read/write mode. By default it mount as a read only mode.

Then execute the chroot command on the /sysroot partition

Now Change the root password by using the passwd command

Then execte the command as like below

Enjoy with new password.