Created
January 29, 2025 13:09
-
-
Save agvxov/5982f0f92b8a3b623d173435cc48bd38 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
XXX: | |
>basic knowledge of public key cryptography | |
>the server holds a public key, while the client has a private key | |
which it will use for authentication | |
>this way we protect from brute forcing attacks and | |
optionally avoid having to enter a password manually when connecting | |
1. Create a key pair | |
Green( anon@Client )$ ssh-keygen | |
"Generating public/private rsa key pair." | |
"Enter file in which to save the key (/home/anon/.ssh/id_rsa):" <path> | |
"Enter passphrase (empty for no passphrase):" [password] | |
"Enter same passphrase again:" [password] | |
"Your identification has been saved in ignore" | |
"Your public key has been saved in ignore.pub" | |
"The key fingerprint is:" | |
"SHA256:sAswBDPwdk6wqK8HSOvDBRUrJmYbA0O9i8ZAmTbxve0 anon@Client" | |
"The key's randomart image is:" | |
"+---[RSA 3072]----+ " | |
"|=o=.o o * | " | |
"|.Xx+o+ + a | " | |
"|+BB o.o . b | " | |
"|*o* o | " | |
"|+o* o...S | " | |
"|.=.B .+ r | " | |
"|+ ..+ oE | " | |
"| + .jklas8u | " | |
"| o. | " | |
"+----[SHA256]-----+ " | |
¤NOTES: | |
<path> : if you're following this tutorial then the default probably good enough for you | |
[password] : optional password; your private key will be encrypted with this, | |
which makes it secure from being plainly stolen, | |
however do note that you'll have to enter it | |
whenever with every new ssh-agent session; | |
dont be afraid to leave it empty | |
2. Get the server's identifier | |
>if the server is located on the LAN use: | |
Red( root@Server )$ ip a | |
//look for the num string which fits the pattern: | |
192.168.0.<int> | |
>if the server is located on WAN look up its IP online | |
>if the server has a register-ed domain use that | |
>NOTE: use whatever you got as "<targer>" from now on | |
3. Add the key to the server | |
Green( anon@Client )$ ssh-copy-id <target> | |
>if the key location is not the default explicit-ly specify its path using the `-i` flag | |
4. Login to the server | |
Green( anon@Client )$ ssh <targer> | |
>this step serves as both ground work for easing the next step and as a test | |
>if you're prompted for a password something went terribly wrong, do not proceed | |
5. Disable password authentication | |
Red( root@Server )$ ${EDITOR} /etc/ssh/sshd_config | |
¤add or modify lines to match the following rules: | |
PubkeyAuthentication yes | |
PasswordAuthentication no | |
6. Restart ssh server | |
Red( root@Server )$ systemctl restart sshd | |
Troubleshooting: | |
¤permissions | |
>ssh is very sensitive to the correct permissions on the server | |
(for understandable security reasons, but the error reporting ain't great) | |
:--------------:------------------------: | |
| Permission | File | | |
:--------------:------------------------: | |
: 755 : ~/ : | |
: 700 : ~/.ssh/ : | |
: 600 : ~/.ssh/authorized_keys : | |
:--------------:------------------------: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment