SSH Key-Based Login and Disable Password Authentication Tutorial

Preface

Whether for personal VPS or enterprise servers accessible via the public internet, if SSH password authentication on port 22 is enabled, it is a common tragedy that hackers may frequently brute-force their way in. Enterprises can restrict access via firewalls, and ordinary users might protect themselves by changing the port number and strengthening weak passwords. However, the relatively secure and simple solution currently is to use SSH key-based login and disable password authentication. This is the most relatively secure login management method.

Generate PublicKey

We recommend setting and remembering a passphrase. The following example uses Linux generation.

Linux: ssh-keygen -t rsa
[Private Key (id_rsa) and Public Key (id_rsa.pub)]

# Generate SSH key pair
ssh-keygen -t rsa

Generating public/private rsa key pair.
# It is recommended to press Enter directly to use the default path
Enter file in which to save the key (/root/.ssh/id_rsa): 
# Enter passphrase (press Enter directly to leave empty)
Enter passphrase (empty for no passphrase): 
# Repeat passphrase
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
aa:8b:61:13:38:ad:b5:49:ca:51:45:b9:77:e1:97:e1 root@localhost.localdomain
The key's randomart image is:
+--[ RSA 2048]----+
|    .o.          |
|    ..   . .     |
|   .  . . o o    |
| o.  . . o E     |
|o.=   . S .      |
|.*.+   .         |
|o.*   .          |
| . + .           |
|  . o.           |
+-----------------+

Copy Key Pair

You can also manually create the directory and authorized_keys file on the client side. Note to modify permissions.

# Copy public key to the server for passwordless login. If port 22 is changed, use the command below
# ssh-copy-id -i ~/.ssh/id_rsa.pub "-p 10022 user@server"
ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.1.241

Modify SSH Configuration File

# Edit sshd_config file
vi /etc/ssh/sshd_config

# Disable password authentication
PasswordAuthentication no
# Enable key authentication
RSAAuthentication yes
PubkeyAuthentication yes
# Specify public key database file
AuthorsizedKeysFile .ssh/authorized_keys

sed -i "s/^PasswordAuthentication.*/PasswordAuthentication no/g" /etc/ssh/sshd_config
sed -i "s/^#RSAAuthentication.*/RSAAuthentication yes/g" /etc/ssh/sshd_config
sed -i "s/^#PubkeyAuthentication.*/PubkeyAuthentication yes/g" /etc/ssh/sshd_config
sed -i "s/^#AuthorizedKeysFile.*/AuthorizedKeysFile .ssh/authorized_keys/g" /etc/ssh/sshd_config


It is recommended to keep an additional session open before restarting the SSH service to prevent any mishaps.

# RHEL/CentOS systems
service sshd restart
# Ubuntu systems
service ssh restart
# Debian systems
/etc/init.d/ssh restart

Manually Add Management Users

You can add user comment identifiers after == for easier management.

echo 'ssh-rsa XXXX' >>/root/.ssh/authorized_keys

# Verify
cat /root/.ssh/authorized_keys