Sunday, January 1, 2017
ssh how to disable password and allow only key authentication
Key authentication is more secure over password authentication. Just because users might have weak passwords, an attacker can easily brute force them. On the other hand, it's impossible to brute force ssh key. That's why I encourage you to use ssh key authentication and below I will show you how to configure it.
1. Generate key on client machine.
You will be asked to enter path to your key, default path would be OK. Also you may enter passphrase or leave it empty.
2. Copy public key to ssh server and remove it from client machine.
3. ssh to your server using password.
4. Create .ssh directory, set permissions
5. Append public key to authorized keys, set permissions:
6. Edit /etc/ssh/sshd_config using any text editor and set the following settings:
7. Reload configuration for your ssh service (or restart):
8. Now ssh to your server using password and make sure you get permission denied error.
9. Finally, ssh to your server using private key. You should successfully connect without any password prompt.
Client part
1. Generate key on client machine.
ssh-keygen
You will be asked to enter path to your key, default path would be OK. Also you may enter passphrase or leave it empty.
2. Copy public key to ssh server and remove it from client machine.
scp yourkey.pub username@yourserver.com:~/ rm yourkey.pub
Server part
3. ssh to your server using password.
ssh username@yourserver.com
4. Create .ssh directory, set permissions
mkdir -p ~/.ssh chmod 700 ~/.ssh
5. Append public key to authorized keys, set permissions:
cat ~/yourkey.pub >> ~/.ssh/authorized_keys chmod 600 ~/.ssh/authorized_keys
6. Edit /etc/ssh/sshd_config using any text editor and set the following settings:
RSAAuthentication yes PubkeyAuthentication yes PermitEmptyPasswords no PasswordAuthentication no ChallengeResponseAuthentication no UsePAM no
7. Reload configuration for your ssh service (or restart):
sudo service ssh reload
8. Now ssh to your server using password and make sure you get permission denied error.
ssh username@yourserver.com
9. Finally, ssh to your server using private key. You should successfully connect without any password prompt.
ssh -i yourkey username@yourserver.com
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment