Set Up SSH for Key Authenticated Access
SSH, or Secure SHell provides a method of remotely accessing the Linux console (terminal). This enables computers to be administered remotely, thus eliminating the need to physically access the machine (or even have a monitor and keyboard attached to the machine full-time).
SSH for Windows Users
Accessing an SSH server from Windows is possible via Cygwin, a free package that provides a POSIX environment for Windows. Cygwin also has an X-Windows server which allows remote use of the Linux desktop. Those who wish to use X-Windows remotely on Windows should download and install Cygwin as per instructions on the X-Cygwin home-page.
Setting up a Secure SSH Server
Saying "a Secure SSH Server" sounds a bit silly since SSH stands for Secure SHell. However, whilst SSH communicates over an encrypted network link, the client machine does not necessarily have to authenticate itself. All that is required is the correct username and password, and access is granted. If a machine is accessible via the internet (allowing remote administration from anywhere in the world) then there is always the risk of ???????? As with other instructions, the following instructions are for Debian, or a similar set up. Of course, the same is possible with most other Linux distributions, but the steps will have to be adapted.
For the following steps, replace "username" with theactual usename of the user, and "hostname" with the URL (or IP address) of the server:
- Install SSH:
apt-get install ssh
- On the remote machine, create a key for each user that requires access:
ssh-keygen<enter a passphrase when prompted>
- The above step should be repeated for each remote machine. Alternatively, it is okay to copy the key files from /home/username/.ssh/ (the files are id_rsa and id_rsa.pub. My advice would be to create separate keys for each remote machine and user so that compromised keys can be deleted from the server for a single machine, should that machine be compromised.
- On the server, create directories to hold the key authorization file, that is, for every user that requires remote access (note: the following assumes that you are logged in as root):
su username .ssh
chmod 700 .ssh
- On the remote machine (or on each remote machine if there are multiple machines) copy the public key files over to the server. For multiple machines, you will have to give each key a unique name:
scp .ssh/id_rsa.pub username@hostname:.ssh/id_rsa.pub
- Add the public keys to the authorization file. For each key:
cat .ssh/id_rsa.pub >> .ssh/authorized_keys
- Restrict access to authorized_keys:
chmod 600 .ssh/authorized_keys
- Now modify the configuration file for the server so that it requires authorized keys for remote access. Open /etc/ssh/sshd_config and insert the following lines (it is best to uncomment the existing lines by removing the "#" character in front,and modify them):
- Restart the server:
- Test that you can connect remotely; on the remote machine:
- It is also a good idea to test that the public key is required. This can be achieved by attempting a log in from another machine without a key, or temporarily moving the /home/username/.ssh directory elsewhere and then logging in. Such attempts should fail. If so, the SSH server is secure.
Articles » A (Linux) Server for Software Developers » Set Up SSH for Key Authenticated Access