Secure Shell (SSH) is an encrypted network protocol designed to make secure connections between clients and servers. The two most p...
Secure Shell (SSH) is an encrypted network protocol designed to make secure connections between clients and servers.
The two most popular methods of SSH authorization are password-based authentication, and public key-based authentication. Using SSH keys is usually more secure and convenient than traditional password authentication.
This article describes how to generate SSH keys on CentOS 8. We will show you how to set up an SSH key and connect to a remote server without using a password.
1. Creating SSH keys on CentOS
It is likely that you already have an SSH key pair on your CentOS client. If you are generating a new key pair, the old one will be overwritten.
Run the following ls command to check if the key file exists.
ls -l ~/.ssh/id_*.pub
If the command line output is something like: No such file or directory or no matches found, it means that the user does not have an SSH key pair, and you can proceed to the next step to generate an SSH key pair.
Otherwise, if you have an SSH key pair, you can use them directly, or backup the old one and generate a new one.
To generate a 4096-bit SSH key pair using your email address as a comment, enter the following command.
ssh-keygen -t rsa -b 4096 -C "your_email@domain.com"
You will be prompted to specify the file name.
Enter file in which to save the key (/home/yourusername/.ssh/id_rsa):
Enter Enter to accept the default file location and file name.
In the next step, you will be asked to enter a security password. Whether you need to set this security password or not is entirely up to you. A secure password will be more secure. If you do not want a secure password, enter.
Enter passphrase (empty for no passphrase):
The whole interaction looks like this.
To verify that your new SSH key is generated, enter.
ls ~/.ssh/id_*
Output.
/home/yourusername/.ssh/id_rsa /home/yourusername/.ssh/id_rsa.pub
2. Copy the public key to the server
Now that the SSH key has been generated, the next step is to copy the public key to the server you want to manage.
The easiest and most recommended way to copy the public key to a remote server is to use the ssh-copy-id tool. In your local machine terminal type.
ssh-copy-id remote_username@server_ip_address
This command will ask you to enter the remote_username password:
remote_username@server_ip_address's password:
Once the user is authorized, the public key file (~/.ssh/id_rsa.pub) will be appended to the remote user's ~/.ssh/authorized_keys file, and the connection will be closed.
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'username@server_ip_address'"
and check to make sure that only the key(s) you wanted were added.
If ssh-copy-id is not available on your local computer, use the following command to copy the public key.
cat ~/.ssh/id_rsa.pub | ssh remote_username@server_ip_address "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
3 Login to your server using SSH key
After completing the above steps, you should be able to log in to the remote server directly without entering a password.
To verify it, try logging in to your server via SSH at
ssh remote_username@server_ip_address
If you do not have a password for your private key, you will be able to log in to the server very quickly. Otherwise, you will be asked to enter your password.
4. Disable Password Authentication
To make the remote server more secure, you can disable SSH password authentication.
Before proceeding, make sure that you can log in to your server as a sudo privileged user without using a password.
Follow the steps below to disable SSH password authentication.
01. Log in to your remote server.
ssh sudo_user@server_ip_address
02. Use your text editor to open the SSH configuration file etc/ssh/sshd_config:
sudo nano /etc/ssh/sshd_config
03. Search for the following command and modify it as follows.
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
04. Finish, save the file, and restart the SSH server by entering.
sudo systemctl restart ssh
Now, password-based authentication is disabled.
5. Summary
We showed you how to generate a new SSH key pair and set up SSH-based authentication. You can use the same key to manage multiple remote servers. You have learned how to disable password authentication and increase the security of your server.
By default, SSH listens on port 22, and changing this default SSH port reduces the risk of automated attacks. To simplify your workflow, use the SSH configuration file to define all SSH connections.
COMMENTS