Introduction
SSH (secure shell) is the encrypted protocol used to administer and interact with servers. You will spend maximum time in the terminal session connected to your server through SSH when working with an Ubuntu server.
In this guide, you will learn how to set up SSH keys for Ubuntu 18.04 installation. SSH keys deliver an easy and secure way of logging into your server also is recommended for all users.
STEP 1 – Create the RSA Key Pair
Create a key pair on the client machine (generally your computer):
ssh-keygen will create a 2048-bit RSA key pair by default, which is safe for most used cases (you can pass in the -b 4096 flag to create a higher 4096-bit key optionally).
After executing the command, you will see the following output:
Hit Enter to save the key pair into the .ssh/ subdirectory in your root (home) directory or define an alternate path.
You may see the following prompt if you had generated an SSH key pair previously:
If you want to overwrite the key on disk, you will be unable to verify using the previous key anymore. Be very careful when choosing yes because this is a deadly process that cannot be reversed.
You should then see the following prompt:
Here you optionally can enter a secure passphrase, highly recommended. A passphrase adds an extra security level to prevent unauthorised users from logging in.
You will see the following output:
You currently have a public and private key that you can use to authenticate. Next, put the public key on your server so that you’ll be able to use SSH-key-based authentication to log in.
STEP 2 – Copy the Public Key to Ubuntu Server
The fastest way to copy your public key to the Ubuntu host is to use a utility named ssh-copy-id. This method is highly recommended due to its simplicity. If you don’t have ssh-copy-id available for you on your client machine, you can use one of the two alternative methods given in this section (manually copying the key or copying through password-based SSH).
Copying Public Key Using ssh-copy-id
The ssh-copy-id tool is built-in by default in multiple operating systems so you can access it on your local system. For this method to work, you need password-based SSH access to your server.
You simply need to define the remote host that you wish to connect as well as password-based SSH user account access to use the utility. Your public SSH key will be copied to this account.
The syntax is:
You will see the following message:
After that, the utility will scan your local account for the id_rsa.pub key that we created previously. It will prompt you for the password of the remote user’s account after it finds the key.
Type the password (password will not be displayed for security purposes) and hit ENTER. The utility will connect to the account on the remote host using the password you entered. Then it will copy the details of your ~/.ssh/id_rsa.pub key into a file in the remote account’s home ~/.ssh directory named authorized_keys.
You can see the following output:
At the same time, your id_rsa.pub key has been uploaded to the remote account. You can continue with STEP 3.
Copying Public Key Using SSH
If you don’t have ssh-copy-id ready, but you have password-based SSH access to an account on your server, you can upload your keys using a standard SSH method.
We can do this through the cat command to read the contents of the public SSH key on our local machine and channeling that by using an SSH connection to the remote server.
As well as, we can ensure that the ~/.ssh directory exists and needs the correct permissions under the account we’re using.
We can then output the content we channeled, ended into a file named authorized_keys within this directory. We’ll use the >> redirect symbol to affix the content rather overwriting it. This will allow us to add keys without killing previously added keys.
The command looks like this:
You may get the following message:
This means that your local computer does not identify the remote host. This can happen the first time you connect to a new host. Type “yes” and press ENTER to continue.
Then, you will be prompted to enter the remote user account password:
After entering your password, the details of your id_rsa.pub key will be copied at the end of the authorized_keys file of the remote user’s account. If it was successful, continue with STEP 3.
Copying Public Key Manually
You have to finish the above process manually, if you do not have password-based SSH access to your server accessible.
We will manually affix the content of your id_rsa.pub file to the ~/.ssh/authorized_keys file on your remote computer.
To show the content of your id_rsa.pub key, type the following into your local machine:
You will see the key’s content, It looks something like this:
Access your remote host using that method you have available.
Once you gain access to your account on the remote server, ensure the ~/.ssh directory exists. The following command will create the directory if required, or do nothing if it already exists:
Now, you can create or edit the authorized_keys file within this directory. You also can add the contents of your id_rsa.pub file to the end of the authorized_keys file, creating it if required through this command:
In the above command, replace the public_key_string with the output from the cat ~/.ssh/id_rsa.pub command that you performed on your local machine. It should start with ssh-rsa ABCD….
Finally, we will make sure that the ~/.ssh directory and authorized_keys file have the relevant permissions set:
This repeatedly removes all “group” and “other” permissions for the ~/.ssh/ directory.
If you are using the root account to set up keys for a user account, it’s also necessary that the ~/.ssh directory refers to the user and not to root:
In this guide, our user is named alex but you have to replace the relevant username into the above command.
STEP 3 – Authenticate to Ubuntu Server Using SSH Keys
If you have successfully performed one of the procedures mentioned above, you don’t require the remote account’s password to log into the remote host.
The basic process is the same:
If this is your first time connecting to this host (if you did the last process mentioned above), you may look something like this:
This means that your local machine does not identify the remote host. Type “yes” and then press the ENTER button to continue.
If you didn’t provide a passphrase for your private key, you will be logged in instantly. If you provided a passphrase for the private key when you created the key, you will be prompted to enter it now. After validating, a new shell session will open for you with the configured account on the Ubuntu server.
Note: Your keystrokes will not display in the terminal session for security purposes.
If key-based authentication is performed successfully, continue on STEP 4 to see how to more secure your system by disabling password authentication.
STEP 4 – Disable Password Authentication on your Server
If you are able to log into your account through SSH without a password, you have successfully configured SSH-key-based authentication to your account. But, your password-based authentication mechanism is still alive, indicating that your server is still exposed to brute-force attacks.
Before executing the steps in this section, ensure that you either have SSH-key-based authentication configured for the root account or preferably, for a non-root account on this server with sudo privileges. This step will lock down password-based logins, so making sure that you will still be able to get administrative access is critical.
When you have verified that your remote account has administrative rights, log in to your remote server through SSH keys, either as root or with an account with sudo privileges. Then, open up the SSH daemon’s configuration file:
Search for a directive named PasswordAuthentication inside the file. This might be commented out. Uncomment the line and set the value as “no”. This will disable your capability to log in through SSH using account passwords:
PasswordAuthentication no
…
Save and Close the file once you are completed by pressing CTRL + X, then enter Y to confirm saving the file and finally hit the ENTER button to exit nano. To execute these changes, we require restarting the sshd service:
For safety, open up a new terminal window and check that the SSH service is working correctly before closing this session:
Once you have verified your SSH service, you can safely close all current server sessions.
The SSH daemon now only responds to SSH keys on your Ubuntu server. Password-based authentication has successfully been disabled.
Conclusion
You should now have configured SSH-key-based authentication on your server, which allows you to sign in without giving an account password.
