How To Configure SSH Key-based Authentication In Linux
What is SSH Key-based authentication?
As we all know, SSH, also known as Secure Shell, is the cryptographic network protocol that allows you to securely communicate/access a remote system over unsecured network, for example Internet. Whenever you send a data over an unsecured network using SSH, the data will be automatically encrypted in the source system, and decrypted in the destination side. SSH provides four authentication methods namely password-based authentication, key-based authentication, Host-based authentication, and Keyboard authentication. The most commonly used authentication methods are password-based and key-based authentication.
In password-based authentication, all you need is the password of the remote system’s user. If you know the password of remote user, you can access the respective system using “ssh user@remote-system-name”. On the other hand, in key-based authentication, you need to generate SSH key pairs and upload the SSH public key to the remote system in order to communicate it via SSH. Each SSH key pair consists of a private key and public key. The private key should be kept within the client system, and the public key should uploaded to the remote SSH server. You shouldn’t not disclose the private key to anyone. Hope you got the basic idea about SSH and its authentication methods.
In this brief tutorial, we will be discussing how to configure SSH key-based authentication in Linux.
Configure SSH Key-based Authentication In Linux
For the purpose of this guide, I will be using CentOS 7 as SSH server and Ubuntu 16.04 LTS as client system.
SSH Server details:
- OS : CentOS 7 64-bit minimal edition
- IP address : 192.168.1.150/24
SSH client details:
- OS : Ubuntu 16.04 LTS 64-bit minimal system
- IP address : 192.168.1.103/24
Client side configuration
Like I said already, in SSH key-based authentication method, the public key should be uploaded to the remote system that you want to access via SSH. The public keys will usually be stored in a file called ~/.ssh/authorized_keys in the remote SSH systems.
Important note: Do not generate key pairs as root, as only root would be able to use those keys. Create key pairs as normal user.
Now, let us create the SSH key pair in the client system. To do so, run the following command in your client system.
ssh-keygen
The above command will create 2048 bit RSA key pair. Enter the passphrase twice. More importantly, Remember your passphrase. You’ll need it later.
Sample output:
Generating public/private rsa key pair.
Enter file in which to save the key (/home/ostechnix/.ssh/id_rsa):
Created directory '/home/ostechnix/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/ostechnix/.ssh/id_rsa.
Your public key has been saved in /home/ostechnix/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:gCswMvywVrbhuVsExLb9WpwpUTd20N9T0jTPkiVJLb0 ostechnix@ubuntuserver
The key's randomart image is:
+---[RSA 2048]----+
| .. .o .oBo|
|. .o . . + o +=B|
|=o.=+ o o o . +o=|
|.+B.=+ . . E |
| o.=..+ S .|
|. .o. * |
| . .+ |
| o. |
| . |
+----[SHA256]-----+
In case you have already created the key pair, you will see the following message. Just type “y” to create overwrite the existing key .
/home/username/.ssh/id_rsa already exists.
Overwrite (y/n)?
Now, we have created the key pair in the client system. Now, copy the SSH public key to your remote SSH server using command:
ssh-copy-id sk@192.168.1.150
Here, I will be copying the client (Ubuntu 16.04 LTS) system’s public key to the remote SSH server (CentOS 7 in my case). Technically speaking, the above command will copy the contents of client system’s ~/.ssh/id_rsa.pub key into remote system’s ~/.ssh/authorized_keys file. Clear? Good.
Type yes to continue connecting to your remote SSH server. And, then Enter the root user’s password of the remote system.
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/ostechnix/.ssh/id_rsa.pub"
The authenticity of host '192.168.1.150 (192.168.1.150)' can't be established.
ECDSA key fingerprint is SHA256:U7I0O1OOzzbHFlhIG0HoGDr1usHzLBju6Jmr6bUB9Es.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
sk@192.168.1.150's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'root@192.168.1.150'"
and check to make sure that only the key(s) you wanted were added.
We have successfully added the SSH public key to the remote SSH server. No, let us disable the password-based authentication completely. Because, we have configured key-based authentication, so we don’t need password-base authentication anymore.
Server side configuration
You need to perform the following commands as root user.
To disable password-based authentication, go to your remote server’s console and edit /etc/ssh/sshd_config configuration file using any editor:
vi /etc/ssh/sshd_config
Find the following line. Uncomment it and set its as no.
PasswordAuthentication no
Restart ssh service to take effect the changes.
systemctl restart sshd
Access SSH server from Client system
Go to your Client system and SSH into your remote server using command:
ssh sk@192.168.1.150
Enter the passphrase.
Sample output:
Enter passphrase for key '/home/ostechnix/.ssh/id_rsa':
Last login: Tue Jan 31 19:01:43 2017 from sk
[sk@server1 ~]#
Now, you’ll be able to SSH into your remote system. As you noticed, we have logged-in to the remote system’s account using passphrase, not using the actual account’s password.
If you try to ssh from another client system, you will get this error message. Say for example, I am tried to SSH into my CentOS 7 server from my Arch Linux using command:
ssh sk@192.168.1.150
Sample output:
The authenticity of host '192.168.1.150 (192.168.1.150)' can't be established.
ECDSA key fingerprint is 67:fc:69:b7:d4:4d:fd:6e:38:44:a8:2f:08:ed:f4:21.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.1.150' (ECDSA) to the list of known hosts.
Permission denied (publickey).
As you see in the above output, I can’t SSH into my remote CentOS 7 server from any other systems, except the Ubuntu client.
Adding more Client system’s keys to SSH server
This is very important. Like I said already, you can’t access the remote system via SSH, except the one you configured (In our case it’s Ubuntu). I want to give permissions to more clients to access the remote SSH server. What should I do? Simple. You need to generate the SSH key pair in your client systems and copy the ssh public key manually to the remote server that you want to access via SSH.
To create SSH key pair, run:
ssh-keygen
Enter the passphrase twice. Now, the ssh key pair is generated. You need to copy the public ssh key (not private key) to your remote server manually.
Display the pub key using command:
cat ~/.ssh/id_rsa.pub
You should an output something like below.
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt3a9tIeK5rPx9p74/KjEVXa6/OODyRp0QLS/sLp8W6iTxFL+UgALZlupVNgFjvRR5luJ9dLHWwc+d4umavAWz708e6Na9ftEPQtC28rTFsHwmyLKvLkzcGkC5+A0NdbiDZLaK3K3wgq1jzYYKT5k+IaNS6vtrx5LDObcPNPEBDt4vTixQ7GZHrDUUk5586IKeFfwMCWguHveTN7ykmo2EyL2rV7TmYq+eY2ZqqcsoK0fzXMK7iifGXVmuqTkAmZLGZK8a3bPb6VZd7KFum3Ezbu4BXZGp7FVhnOMgau2kYeOH/ItKPzpCAn+dg3NAAziCCxnII9b4nSSGz3mMY4Y7 ostechnix@ubuntuserver
Copy the entire contents and go to your remote server’s console. Create a directory called ssh in the home directory as shown below. You need to execute the following commands as root user.
mkdir -p ~/.ssh
Now, append the your client system’s pub key which you generated in the previous step in a file called
echo {Your_public_key_contents_here} >> ~/.ssh/authorized_keys
Restart ssh service on the remote system. Now, you’ll be able to SSH to your server from the new client.
That’s it. SSH Key-based authentication provides an extra layer protection from brute-force attacks. Configuring key-based authentication is not that difficult either.
