Secure Linux Login Connection

Introduction

SSH of­fers two meth­ods of au­then­ti­ca­tion: pass­word and key pair au­then­ti­ca­tion.

• Password Authentication: While simple passwords are easily remembered, they are also easily compromised through brute force attacks. On the other hand, complex passwords, though safer, are challenging to remember.
• Key Pair Authentication: This method involves a combination of a public key and a private key. The public key is placed on the device that one wishes to access, while the private key is stored on the user's local machine. Only the holder of the private key can access the device, making this method secure and convenient.

Generating a Key Pair with ssh-keygen

The ssh-keygen com­mand can be used to gen­er­ate a key pair. Here is how to use it:

ssh-keygen

For a stronger key pair, use:

ssh-keygen -t rsa -b 4096 -C $comment

Note: When prompted, hit En­ter for each prompt.

Uploading the Public Key to the Remote Host

There are two ways to up­load the pub­lic key: man­u­ally and au­to­mat­i­cally.

Automatic Upload

To au­to­mat­i­cally up­load the pub­lic key, run:

ssh-copy-id user@remoteHost

Or spec­ify the pub­lic key and port:

ssh-copy-id -i ~/.ssh/id_rsa.pub user@remoteHost

Manual Upload

To man­u­ally up­load the pub­lic key, copy the pub­lic key con­tent:

ssh user@remoteHost 'mkdir -p .ssh && cat >> .ssh/authorized_keys' < ~/.ssh/id_rsa.pub

Next, set the cor­rect per­mis­sions on the re­mote host:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Af­ter cre­at­ing the authorized_keys file and past­ing the pub­lic key con­tents into it, we can log in with­out a pass­word:

ssh user@remoteHost

Managing Sessions via SSH Profiles

SSH pro­files are an el­e­gant and ef­fi­cient way to man­age mul­ti­ple re­mote lo­gins. You can cre­ate sev­eral re­mote hosts on the SSH pro­files as shown:

cat >> ~/.ssh/config << EOF
Host HOST01
    HostName 123.123.123.33
    Port 22
    User user01
    IdentityFile "~/.ssh/id_rsa"
    IdentitiesOnly yes

Host HOST02
    HostName 10.110.254.99
    Port 2222
    User user02
    IdentityFile "~/.ssh/id_ecdsa"
    IdentitiesOnly yes
EOF

En­sure that you set the cor­rect per­mis­sions on the SSH pro­files:

chmod 600 ~/.ssh/config

Af­ter set­ting up the SSH pro­files, you can log in by sim­ply en­ter­ing the alias name:

ssh HOST01

Disabling Password Login

For se­cu­rity rea­sons, it is rec­om­mended to dis­able pass­word lo­gin:

sudo sed -i "s@.*\(PasswordAuthentication \).*@\1no@" /etc/ssh/sshd_config
sudo service sshd restart

One-Key Configuration on SSH

Set­ting up a new re­mote host key lo­gin re­quires sev­eral steps such as key pair gen­er­a­tion, per­mis­sions set­ting, pub­lic key up­load, and pass­word dis­abling.

How­ever, we can up­load all the pub­lic keys to Github SSH keys, and then de­ploy the pub­lic key with one com­mand on the new re­mote host:

curl -fsSL https://github.com/$githubUser.keys >> ~/.ssh/authorized_keys

Also, dis­able the pass­word and restart the SSH dae­mon:

sudo sed -i "s@.*\(PasswordAuthentication \).*@\1no@" /etc/ssh/sshd_config
sudo service sshd restart

Ad­di­tion­ally, we can sim­plify the process us­ing P3TERX's SSH Key Installer:

bash <(curl -fsSL git.io/key.sh) -g $githubUser -d

Deploying the Public Key

Here are some ways of get­ting the pub­lic key:

i. Get the pub­lic key from Github:

bash <(curl -fsSL git.io/key.sh) -g $githubUser

ii. Get the pub­lic key from a URL:

bash <(curl -fsSL git.io/key.sh) -u https://keyaddress.com/id_rsa.pub

iii. Over­write mode will com­pletely re­place the pre­vi­ous key on /.ssh/authorized_keys:

bash <(curl -fsSL git.io/key.sh) -o -g $githubUser

iv. Dis­able pass­word lo­gin:

bash <(bash <(curl -fsSL git.io/key.sh) -d

v. Mod­ify the SSH port:

bash <(curl -fsSL git.io/key.sh) -p 2222

Conclusion

Whether man­u­ally or au­to­mat­i­cally, man­ag­ing SSH keys in­volves cre­at­ing a se­cure key pair, up­load­ing the pub­lic key to the in­tended de­vice, and man­ag­ing ses­sions us­ing SSH pro­files. For in­creased se­cu­rity, it is ad­vis­able to dis­able pass­word lo­gins. Var­i­ous tools such as P3TERX's SSH Key In­staller can sim­plify these processes.

Reference

• 使用 ssh-keygen 和 ssh-copy-id 組態 SSH 金鑰實現免密登陸
• SSH 金鑰一鍵組態指令碼 使用教學

Related:

• SSH Tunneling
• Securely Transfer Files Over The Network