Cyberstudy
Supplementary — not from your PDF Intermediate ~35 min

Harden SSH with key-based login

Replace password logins with an SSH key pair on your practice VM, then turn off password and root login.

Environment

Two VMs on your host-only network, or your PC plus one VM.

Before you start

  • Read Secure Shell (p.150) and Asymmetric Encryption (p.53).

You will

  • Generate an SSH key pair
  • Install the public key on a server
  • Disable password and root authentication

Steps

  1. 1

    On the client, generate a key: ssh-keygen -t ed25519 -C "lab key" and set a passphrase.

  2. 2

    Copy the public key to the server: ssh-copy-id user@<vm-ip> (or append it to ~/.ssh/authorized_keys by hand).

  3. 3

    Log in with ssh user@<vm-ip>. It should ask for the key passphrase, not the account password.

  4. 4

    On the server, edit /etc/ssh/sshd_config: set PasswordAuthentication no and PermitRootLogin no.

  5. 5

    Check the config with sudo sshd -t, then sudo systemctl restart ssh.

  6. 6

    From a client without the key, try to log in and confirm password login is refused.

  7. 7

    Look at the server's fingerprint (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub) and match it to what the client showed on first connect.

Check your understanding

  • ?Which half of the key pair goes on the server?
  • ?What attack does checking the host key fingerprint protect against?
  • ?Why protect the private key with a passphrase?