Set up and secure SSH

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Log in and run remote commands

ssh USER@HOST opens a shell. ssh USER@HOST COMMAND runs one command and comes back.

$ssh student@server2
$ssh server2 'uptime; df -h /'
$ssh -p 2222 admin@server2
$ssh -J jump.example.com student@db1.internal
$ssh -t server2 sudo systemctl restart httpd
$ssh -v server2

Option	Use
`-p PORT`	The server listens on another port
`-i FILE`	Use this private key
`-J HOST`	Go through a jump host (bastion)
`-t`	Give a terminal, needed for `sudo` password prompts
`-v` / `-vvv`	Debug output: shows why a login fails

19.2

Trust host keys

Every SSH server has host keys. At the first login you check the fingerprint; SSH saves it in ~/.ssh/known_hosts and warns if it ever changes.

On the server, show its fingerprint (send it to the users in a safe way):

#ls /etc/ssh/ssh_host_*_key.pub
/etc/ssh/ssh_host_ecdsa_key.pub  /etc/ssh/ssh_host_ed25519_key.pub  /etc/ssh/ssh_host_rsa_key.pub
#ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
256 SHA256:Wp1tH3d2c0QhC8bXl9Zr5yJm6nK4aP7sT0uV2xY3zA8 root@server2 (ED25519)

On the client:

$ssh-keygen -F server2
$ssh-keygen -R server2
$ssh-keyscan server2 >> ~/.ssh/known_hosts

File	Meaning
`~/.ssh/known_hosts`	Host keys you trust
`/etc/ssh/ssh_known_hosts`	Host keys trusted for all users (set by the admin)
`/etc/ssh/ssh_host_*_key`	The private host keys of this server (root only)

Watch out

ssh-keygen -R removes the old key. Do it only when you know the server got new keys (reinstalled, new VM). Otherwise the warning can mean an attack.

19.3

Make a key pair

A key pair has a private key (stays with you, secret) and a public key (goes to the servers). Make one with ssh-keygen.

$ssh-keygen -t ed25519 -C "student@laptop"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/student/.ssh/id_ed25519):
Enter passphrase for "/home/student/.ssh/id_ed25519" (empty for no passphrase):
Your identification has been saved in /home/student/.ssh/id_ed25519
Your public key has been saved in /home/student/.ssh/id_ed25519.pub
$ls -l ~/.ssh/
-rw-------. 1 student student 411 Oct 27 12:01 id_ed25519
-rw-r--r--. 1 student student  97 Oct 27 12:01 id_ed25519.pub

ed25519 is short, fast and safe. Use -t rsa -b 4096 only for very old servers.
A passphrase protects the key if somebody steals the file. Use one for personal keys.

Remember

The .pub file is public — copy it anywhere. The file without .pub never leaves your machine.

19.4

Log in with the key

Put your public key into ~/.ssh/authorized_keys on the server. ssh-copy-id does it with the right rights.

$ssh-copy-id student@server2
Number of key(s) added: 1
$ssh student@server2
$ssh-copy-id -i ~/.ssh/deploy_ed25519.pub deploy@server2

By hand (when ssh-copy-id is not possible):

$cat ~/.ssh/id_ed25519.pub | ssh student@server2 'mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

Watch out

SSH ignores keys when the rights are too open: ~/.ssh must be 700 and authorized_keys 600, owned by the user. Check with ls -ld ~/.ssh ~/.ssh/authorized_keys and fix SELinux labels with restorecon -Rv ~/.ssh.

19.5

Use the agent for the passphrase

ssh-agent keeps your unlocked key in memory, so you type the passphrase once per session.

$eval $(ssh-agent)
Agent pid 5120
$ssh-add
Enter passphrase for /home/student/.ssh/id_ed25519:
Identity added: /home/student/.ssh/id_ed25519 (student@laptop)
$ssh-add -l
$ssh server2
$ssh-add -D

In the GNOME desktop an agent already runs; the passphrase is asked once and kept until you log out.

19.6

Save settings in the client config

~/.ssh/config stores user, port, key and jump host per server — then ssh web1 is enough.

~/.ssh/config

Host web1
    HostName 192.168.122.30
    User deploy
    Port 2222
    IdentityFile ~/.ssh/deploy_ed25519
 
Host *.internal
    ProxyJump jump.example.com

$chmod 600 ~/.ssh/config
$ssh web1
$scp report.txt web1:/tmp/

19.7

Secure the SSH server

Change the server in a drop-in file in /etc/ssh/sshd_config.d/. Turn off root login and password login when keys work.

/etc/ssh/sshd_config.d/50-hardening.conf

PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
AllowGroups sshusers wheel

#sshd -t
#systemctl reload sshd
#sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|allowgroups'
permitrootlogin no
passwordauthentication no
allowgroups sshusers wheel

Setting	What it does
`PermitRootLogin no`	root can not log in over SSH at all (`prohibit-password` = only with a key)
`PasswordAuthentication no`	Only keys work — stops password guessing
`MaxAuthTries 3`	Fewer tries per connection
`AllowUsers` / `AllowGroups`	Only these users / groups may log in

Remember

sshd reads the files in sshd_config.d/ (in name order) before the main file, and the first value it reads wins. A drop-in with a low number is the safe way to set your rules.

Watch out

Before PasswordAuthentication no, test the key login in a second terminal, and keep the first session open. If something is wrong, you can still fix it. More: Secure and tune the SSH server.

Log in and run remote commands

Trust host keys

Make a key pair

Log in with the key

Use the agent for the passphrase

Save settings in the client config

Secure the SSH server

Practice

All commands in this chapter