How to: SSH secure key authentication on Ubuntu

Open SSH is the most widely used SSH server on Linux. Using SSH, one can connect to a remote host and gain a shell access on it in a secure manner as all traffic is encrypted.

A neat feature of open SSH is to authenticate a user using a public/private key pair to log into the remote host. By doing so, you won’t be prompted for the remote user’s password when gaining access to a protected server. Of course you have to hold the key for this to work. By using key based authentication and by disabling the standard user/password authentication, we reduce the risk of having someone gaining access to our machine/s. For more info on data access management, visit sites like https://cyral.com/data-access-governance/. And if you need comprehensive visibility to enable compliance and secure data sharing, you might want to read more here to learn more. Moreover, if you need Cyber Security Solutions in charge of data protection of your company, you may look for a time-limited privileged access management system that evaluates each access request. You may click here to find out more.

Implement NIST Cybersecurity Framework in 3 weeks using CyberArrow. CyberArrow is a technology first solution that automates the evidence collection for NIST CSF controls. CyberArrow can be used by any type of organization.

So if you are not using SSH with public/private key pair, here is how to get this rolling. If you are using AWS (Amazon Web Services) you would have been forced to use this method. This is great! The instructions below will teach you a bit about this and provide insight into setting this up on your dev VM or a server which doesn’t have this level of security turned on.

Useful commands to note

Accessing server using key

ssh -i ./Security/PRIVATEKEY USERNAME@SERVER -p PORT

Example:

ssh -i ./Security/aws/myname_rsa root@127.0.0.1 -p 22345

Restart SSH server

sudo /etc/init.d/ssh restart

Install & Setup SSH Security Access

Note: This section is for admins only.

sudo apt-get install openssh-server
sudo apt-get install openssh-client

sudo nano /etc/ssh/sshd_config
sudo /etc/init.d/ssh restart

ssh-keygen -t rsa

sudo mkdir /root/.ssh/

cat /root/.ssh/myname_rsa.pub >> ~/.ssh/authorized_keys
rm /root/.ssh/myname_rsa.pub

chmod 600 ~/.ssh/authorized_keys

sudo nano /etc/ssh/sshd_config

/etc/init.d/ssh reload (or)
service ssh reload

chmod 0600 ./Security/myname_rsa

ssh -i ./Security/KEYFILE USERNAME@SERVER -p PORTNO

ssh -i ./Security/myname_rsa root@1.1.1.1 -p 22345

sudo nano /etc/ssh/sshd_config

ChallengeResponseAuthentication no 
PasswordAuthentication no
UsePAM no

/etc/init.d/ssh reload (or)
service ssh reload

ssh -i ./Security/KEYFILE USERNAME@SERVER -p PORTNO

ssh -i ./Security/myname_rsa root@1.1.1.1 -p 22345

ssh root@1.1.1.1 -p 22345

Finally make sure you adjust your development tools so they tool can gain access to your secured server.

Tools

Your choice of tools my vary but the process is very similar. The following are my most used tools and how to tweak them to allow SSH key entry to my secured server.

FileZilla – SFTP

To enable FileZilla to access the server under the new configuration do this:

1. FileZilla > Preferences…
2. Settings window opens. Select “Connection > SFTP” (left hand navigation).
3. In the right pane, click on “Add keyfile…”. Navigate to your private keyfile and click on it to add.
4. You may be asked by FileZilla to “Convert keyfile” to a supported FileZilla format. This is fine and just click “Yes”. Save the output file to the same location as your private key file.
5. Click OK on the Settings file to save final changes.

SublimeText2 – IDE

To enable SublimeText2 to access the server under the new configuration do this.

In your solutions sftp-settings.json configuration file enable key file access like this:

"ssh_key_file": "~/.ssh/id_rsa",

Example:

"ssh_key_file": "~/Security/myname_rsa",

And that’s it. Happy development!

~ Ernest

Author: Ernest W. Semerda

Aussie in Silicon Valley. Veryfi CoFounder (#YC W17 cohort). GSDfaster Founder. View all posts by Ernest W. Semerda