When you first create a new server, there are a few configuration steps that you should take early on as part of the basic setup. This will increase the security and usability of your server and will give you a solid foundation for subsequent actions.
- Once you are logged in as root, we’re prepared to add the new user account that we will use to log in from now on.
- This example creates a new user called “demo”, but you should replace it with a user name that you like:
adduser demo - Next, assign a password to the new user (again, substitute “demo” with the user that you just created):
passwd demo
Now, we have a new user account with regular account privileges. However, we may sometimes need to do administrative tasks. To avoid having to log out of our normal user and log back in as the root account, we can set up what is known as “super user” or root privileges for our normal account. This will allow our normal user to run commands with administrative privileges by putting the word sudo before each command. To add these privileges to our new user, we need to add the new user to the wheel group. By default, on CentOS 7, users who belong to the “wheel” group are allowed to use the sudo command.
- As root, run this command to add your new user to the wheel group:
gpasswd -a demo wheel
The next step in securing your server is to set up public key authentication for your new user. Setting this up will increase the security of your server by requiring a private SSH key to log in.
- Generate a Key Pair: If you do not already have an SSH key pair, which consists of a public and private key, you need to generate one. If you already have a key that you want to use, skip to the Copy the Public Key step To generate a new key pair, enter the following command at the terminal of your local machine:
ssh-keygen - Next, you will be prompted for a passphrase to secure the key with. You may either enter a passphrase or leave the passphrase blank. Note: If you leave the passphrase blank, you will be able to use the private key for authentication without entering a passphrase. If you enter a passphrase, you will need both the private key and the passphrase to log in. Securing your keys with passphrases is more secure, but both methods have their uses and are more secure than basic password authentication.
- This generates a private key, id_rsa, and a public key, id_rsa.pub, in the .ssh directory of the localuser’s home directory. Remember that the private key should not be shared with anyone who should not have access to your servers!
- Copy the Public Key: After generating an SSH key pair, you will want to copy your public key to your new server. We will cover two easy ways to do this:
- Option 1: Use ssh-copy-id. If your local machine has the ssh-copy-id script installed, you can use it to install your public key to any user that you have login credentials for. Run:
ssh-copy-id demo@SERVER_IP_ADDRESS. After providing your password at the prompt, your public key will be added to the remote user’s.ssh/authorized_keys file. The corresponding private key can now be used to log into the server. - Option 2: Manually Install the Key. Assuming you generated an SSH key pair using the previous step, use the following command at the terminal of your local machine to print your public key (id_rsa.pub):
cat ~/.ssh/id_rsa.pub. Select the public key, and copy it to your clipboard. On the server, as the root user, enter the following command to switch to the new user (substitute your own user name):su - demo. Now you will be in your new user’s home directory. Create a new directory called.sshand restrict its permissions with the following commands:
mkdir .ssh
chmod 700 .ssh
-Now open a file in .ssh called authorized_keys with a text editor
vi .ssh/authorized_keys
- Enter insert mode, by pressing i, then enter your public key (which should be in your clipboard) by pasting it into the editor. Now hit ESC to leave insert mode. Enter :x then ENTER to save and exit the file.
- Now restrict the permissions of the authorized_keys file with this command:
chmod 600 .ssh/authorized_keys - Type this command once to return to the root user:
exit - Now you may SSH login as your new user, using the private key as authentication.
Now that we have our new account, we can secure our server a little bit by modifying its SSH daemon configuration (the program that allows us to log in remotely) to disallow remote SSH access to the root account.
- Open the configuration file with your text editor as root:
vi /etc/ssh/sshd_config - Here, we have the option to disable root login through SSH. This is generally a more secure setting since we can now access our server through our normal user account and escalate privileges when necessary. To disable remote root logins, we need to find the line that looks like this:
/etc/ssh/sshd_config
#PermitRootLogin yes
- Uncomment the line by deleting the “#” symbol (press Shift-x). Now move the cursor to the “yes” by pressing c. Now replace “yes” by pressing cw, then typing in “no”. Hit Escape when you are done editing. It should look like this:
/etc/ssh/sshd_config
PermitRootLogin no
- Disabling remote root login is highly recommended on every server!
- Enter :x then ENTER to save and exit the file.
- Reload SSH. Now that we have made our changes, we need to restart the SSH service so that it will use our new configuration. Type this to restart SSH:
systemctl reload sshd - Now, before we log out of the server, we should test our new configuration. We do not want to disconnect until we can confirm that new connections can be established successfully. Open a new terminal window. In the new window, we need to begin a new connection to our server. This time, instead of using the root account, we want to use the new account that we created.