[{"data":1,"prerenderedAt":468},["ShallowReactive",2],{"i-lucide:sun-moon":3,"i-lucide:menu":8,"post-\u002Fblog\u002F2022-11-23-securing-ssh":10,"surround-\u002Fblog\u002F2022-11-23-securing-ssh":451,"i-lucide:arrow-left":462,"i-lucide:sparkles":464,"i-lucide:user":466},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 2v2m2.837 12.385a6 6 0 1 1-7.223-7.222c.624-.147.97.66.715 1.248a4 4 0 0 0 5.26 5.259c.589-.255 1.396.09 1.248.715M16 12a4 4 0 0 0-4-4m7-3l-1.256 1.256M20 12h2\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"id":11,"title":12,"authors":13,"body":16,"date":436,"description":22,"extension":437,"meta":438,"navigation":441,"path":442,"seo":443,"stem":444,"tags":445,"toc":6,"__hash__":450},"blog\u002Fblog\u002F2022-11-23-securing-ssh.md","Securing SSH with ssh keys",[14,15],"gpt","pfarmer",{"type":17,"value":18,"toc":430},"minimark",[19,23,28,31,54,57,285,295,299,314,326,336,343,349,369,372,390,393,414,426],[20,21,22],"p",{},"In this article I'm going to describe how to secure a SSH server, so that it will only accept logins with ssh keys.",[24,25,27],"h2",{"id":26},"generate-a-set-of-personal-ssh-keys","Generate a set of personal ssh keys",[20,29,30],{},"If you have already done this, you can skip this step.",[32,33,38],"pre",{"className":34,"code":35,"language":36,"meta":37,"style":37},"language-shell shiki shiki-themes github-light github-dark-default","$ ssh-keygen \n","shell","",[39,40,41],"code",{"__ignoreMap":37},[42,43,46,50],"span",{"class":44,"line":45},"line",1,[42,47,49],{"class":48},"sYRkA","$",[42,51,53],{"class":52},"sNbzA"," ssh-keygen\n",[20,55,56],{},"The output should look like this.",[32,58,60],{"className":34,"code":59,"language":36,"meta":37,"style":37},"Generating public\u002Fprivate rsa key pair.\nEnter file in which to save the key (\u002Fhome\u002Fpfarmer\u002F.ssh\u002Fid_rsa):\nEnter passphrase (empty for no passphrase):\nEnter same passphrase again:\nYour identification has been saved in \u002Fhome\u002Fpfarmer\u002F.ssh\u002Fid_rsa\nYour public key has been saved in \u002Fhome\u002Fpfarmer\u002F.ssh\u002Fid_rsa.pub\nThe key fingerprint is:\nSHA256:iHjXjogLDiwNmy3NMc1woBAnGW9ywvUrpy\u002Fh\u002Fd6RqR8 pfarmer@server\nThe key's randomart image is:\n+---[RSA 3072]----+\n|=+o.             |\n|+=...            |\n|+.= ..           |\n| = * ..o         |\n|. +.=oo S        |\n|.O *+o o  o      |\n|B.B.+ . .E       |\n|+o +..  o o      |\n| .. ..o+.o       |\n+----[SHA256]-----+\n",[39,61,62,79,109,131,144,167,188,202,211,219,225,231,237,243,249,255,261,267,273,279],{"__ignoreMap":37},[42,63,64,67,70,73,76],{"class":44,"line":45},[42,65,66],{"class":48},"Generating",[42,68,69],{"class":52}," public\u002Fprivate",[42,71,72],{"class":52}," rsa",[42,74,75],{"class":52}," key",[42,77,78],{"class":52}," pair.\n",[42,80,82,85,88,91,94,97,100,103,105],{"class":44,"line":81},2,[42,83,84],{"class":48},"Enter",[42,86,87],{"class":52}," file",[42,89,90],{"class":52}," in",[42,92,93],{"class":52}," which",[42,95,96],{"class":52}," to",[42,98,99],{"class":52}," save",[42,101,102],{"class":52}," the",[42,104,75],{"class":52},[42,106,108],{"class":107},"szmH1"," (\u002Fhome\u002Fpfarmer\u002F.ssh\u002Fid_rsa):\n",[42,110,112,114,117,120,123,126,128],{"class":44,"line":111},3,[42,113,84],{"class":48},[42,115,116],{"class":52}," passphrase",[42,118,119],{"class":107}," (empty ",[42,121,122],{"class":52},"for",[42,124,125],{"class":52}," no",[42,127,116],{"class":52},[42,129,130],{"class":107},"):\n",[42,132,134,136,139,141],{"class":44,"line":133},4,[42,135,84],{"class":48},[42,137,138],{"class":52}," same",[42,140,116],{"class":52},[42,142,143],{"class":52}," again:\n",[42,145,147,150,153,156,159,162,164],{"class":44,"line":146},5,[42,148,149],{"class":48},"Your",[42,151,152],{"class":52}," identification",[42,154,155],{"class":52}," has",[42,157,158],{"class":52}," been",[42,160,161],{"class":52}," saved",[42,163,90],{"class":52},[42,165,166],{"class":52}," \u002Fhome\u002Fpfarmer\u002F.ssh\u002Fid_rsa\n",[42,168,170,172,175,177,179,181,183,185],{"class":44,"line":169},6,[42,171,149],{"class":48},[42,173,174],{"class":52}," public",[42,176,75],{"class":52},[42,178,155],{"class":52},[42,180,158],{"class":52},[42,182,161],{"class":52},[42,184,90],{"class":52},[42,186,187],{"class":52}," \u002Fhome\u002Fpfarmer\u002F.ssh\u002Fid_rsa.pub\n",[42,189,191,194,196,199],{"class":44,"line":190},7,[42,192,193],{"class":48},"The",[42,195,75],{"class":52},[42,197,198],{"class":52}," fingerprint",[42,200,201],{"class":52}," is:\n",[42,203,205,208],{"class":44,"line":204},8,[42,206,207],{"class":48},"SHA256:iHjXjogLDiwNmy3NMc1woBAnGW9ywvUrpy\u002Fh\u002Fd6RqR8",[42,209,210],{"class":52}," pfarmer@server\n",[42,212,214,216],{"class":44,"line":213},9,[42,215,193],{"class":48},[42,217,218],{"class":52}," key's randomart image is:\n",[42,220,222],{"class":44,"line":221},10,[42,223,224],{"class":52},"+---[RSA 3072]----+\n",[42,226,228],{"class":44,"line":227},11,[42,229,230],{"class":52},"|=+o.             |\n",[42,232,234],{"class":44,"line":233},12,[42,235,236],{"class":52},"|+=...            |\n",[42,238,240],{"class":44,"line":239},13,[42,241,242],{"class":52},"|+.= ..           |\n",[42,244,246],{"class":44,"line":245},14,[42,247,248],{"class":52},"| = * ..o         |\n",[42,250,252],{"class":44,"line":251},15,[42,253,254],{"class":52},"|. +.=oo S        |\n",[42,256,258],{"class":44,"line":257},16,[42,259,260],{"class":52},"|.O *+o o  o      |\n",[42,262,264],{"class":44,"line":263},17,[42,265,266],{"class":52},"|B.B.+ . .E       |\n",[42,268,270],{"class":44,"line":269},18,[42,271,272],{"class":52},"|+o +..  o o      |\n",[42,274,276],{"class":44,"line":275},19,[42,277,278],{"class":52},"| .. ..o+.o       |\n",[42,280,282],{"class":44,"line":281},20,[42,283,284],{"class":52},"+----[SHA256]-----+\n",[20,286,287,291,292],{},[288,289],"binding",{"value":290},"\u003C info >","It would be wise to backup you ssh keys onto a USB stick, later on you will be disabling password authentication on your linux server, and if you only have remote access, if you lose or delete your ssh keys, you won't be able to login to your server again.",[288,293],{"value":294},"\u003C \u002Finfo >",[24,296,298],{"id":297},"copy-your-public-key-to-the-server","Copy your public key to the server",[20,300,301,302,305,306,309,310,313],{},"You now need to copy your public key (",[39,303,304],{},"~\u002F.ssh\u002Fid_rsa.pub",") to the server, and put it in ",[39,307,308],{},"~\u002F.ssh\u002Fauthorized_keys",", fortunately there is a handy script to help you do this, ",[39,311,312],{},"ssh-copy-id",".",[32,315,317],{"className":34,"code":316,"language":36,"meta":37,"style":37},"ssh-copy-id username@servername\n",[39,318,319],{"__ignoreMap":37},[42,320,321,323],{"class":44,"line":45},[42,322,312],{"class":48},[42,324,325],{"class":52}," username@servername\n",[20,327,328,329,331,332,335],{},"You will be prompted to enter you password, once you have entered it correctly, ",[39,330,312],{}," will copy your public key to the server. You should now be able to login to the server with your ssh key, instead of your password, you will now be asked for the passphrase of your ssh key, you can of course setup ",[39,333,334],{},"ssh-agent",", so you don't need to type your ssh key each time.",[24,337,339,340],{"id":338},"update-etcsshsshd_config","Update ",[39,341,342],{},"\u002Fetc\u002Fssh\u002Fsshd_config",[20,344,345,346,348],{},"Now we make some changes to ",[39,347,342],{},", the changes disallow password authentication, and we do a number of other things as well.\nFind and change the following lines;",[32,350,352],{"className":34,"code":351,"language":36,"meta":37,"style":37},"PermitRootLogin yes\nPasswordAuthentication yes\n",[39,353,354,362],{"__ignoreMap":37},[42,355,356,359],{"class":44,"line":45},[42,357,358],{"class":48},"PermitRootLogin",[42,360,361],{"class":52}," yes\n",[42,363,364,367],{"class":44,"line":81},[42,365,366],{"class":48},"PasswordAuthentication",[42,368,361],{"class":52},[20,370,371],{},"to",[32,373,375],{"className":34,"code":374,"language":36,"meta":37,"style":37},"PermitRootLogin no\nPasswordAuthentication no\n",[39,376,377,384],{"__ignoreMap":37},[42,378,379,381],{"class":44,"line":45},[42,380,358],{"class":48},[42,382,383],{"class":52}," no\n",[42,385,386,388],{"class":44,"line":81},[42,387,366],{"class":48},[42,389,383],{"class":52},[20,391,392],{},"Once those changes have been made, you need to restart sshd.",[32,394,396],{"className":34,"code":395,"language":36,"meta":37,"style":37},"$ sudo systemctl restart ssh\n",[39,397,398],{"__ignoreMap":37},[42,399,400,402,405,408,411],{"class":44,"line":45},[42,401,49],{"class":48},[42,403,404],{"class":52}," sudo",[42,406,407],{"class":52}," systemctl",[42,409,410],{"class":52}," restart",[42,412,413],{"class":52}," ssh\n",[20,415,416,418,419,423,424],{},[288,417],{"value":290},"You ",[420,421,422],"strong",{},"won't"," be logged out when you restart sshd, so keep the terminal open, and don't logout of the server until you have confirmed you can login via another terminal window.",[288,425],{"value":294},[427,428,429],"style",{},"html pre.shiki code .sYRkA, html code.shiki .sYRkA{--shiki-default:#6F42C1;--shiki-dark:#FFA657}html pre.shiki code .sNbzA, html code.shiki .sNbzA{--shiki-default:#032F62;--shiki-dark:#A5D6FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .szmH1, html code.shiki .szmH1{--shiki-default:#24292E;--shiki-dark:#E6EDF3}",{"title":37,"searchDepth":111,"depth":111,"links":431},[432,433,434],{"id":26,"depth":81,"text":27},{"id":297,"depth":81,"text":298},{"id":338,"depth":81,"text":435},"Update \u002Fetc\u002Fssh\u002Fsshd_config","2022-11-23","md",{"type":439,"layout":440},"post","blog_page",true,"\u002Fblog\u002F2022-11-23-securing-ssh",{"title":12,"description":22},"blog\u002F2022-11-23-securing-ssh",[446,447,448,449],"sysadmin","devops","linux","ssh","pwM3koRdp4kPlvbE1vaHted53mxpTXtVuvIzAmbrE8E",[452,457],{"title":453,"path":454,"stem":455,"date":456,"children":-1},"Using Python requests","\u002Fblog\u002F2022-11-17-python-requests","blog\u002F2022-11-17-python-requests","2022-11-17",{"title":458,"path":459,"stem":460,"date":461,"children":-1},"Installing Docker on Debian 11","\u002Fblog\u002F2022-12-01-installing-docker-on-debian","blog\u002F2022-12-01-installing-docker-on-debian","2022-12-01",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":463},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":465},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M11.017 2.814a1 1 0 0 1 1.966 0l1.051 5.558a2 2 0 0 0 1.594 1.594l5.558 1.051a1 1 0 0 1 0 1.966l-5.558 1.051a2 2 0 0 0-1.594 1.594l-1.051 5.558a1 1 0 0 1-1.966 0l-1.051-5.558a2 2 0 0 0-1.594-1.594l-5.558-1.051a1 1 0 0 1 0-1.966l5.558-1.051a2 2 0 0 0 1.594-1.594zM20 2v4m2-2h-4\"\u002F>\u003Ccircle cx=\"4\" cy=\"20\" r=\"2\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":467},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2\"\u002F>\u003Ccircle cx=\"12\" cy=\"7\" r=\"4\"\u002F>\u003C\u002Fg>",1783616166590]