SSH Key-Based Authentication

Welcome! In this lesson, you'll learn about SSH key-based authentication. This method is far more secure and convenient than using traditional passwords for logging into your server.

SSH keys act like a digital handshake, proving your identity without needing to type a password every time.

SSH key authentication relies on a pair of cryptographic keys:

• Private Key: This key stays on your local machine and must be kept secret. Think of it as the unique key to your digital lock.
• Public Key: This key is placed on the server you want to access. It's like a special lock that can only be opened by your private key.

When you try to connect, the server challenges your client, which then uses your private key to prove its identity.

You can generate your own SSH key pair using the ssh-keygen command on your local machine. By default, it creates an RSA key pair.

When prompted, you can choose a passphrase to protect your private key. This adds an extra layer of security, requiring you to enter the passphrase before using the key.

For stronger security, it's recommended to use newer key types like ED25519. You can also specify a custom filename for your keys.

• -t ed25519: Specifies the ED25519 algorithm.
• -f ~/.ssh/my_server_key: Creates files named my_server_key and my_server_key.pub.

Always use a strong passphrase for your private key!

After generation, your keys are typically stored in the ~/.ssh/ directory on your local machine. You'll find two files:

• id_ed25519 (or id_rsa): This is your private key. Keep it absolutely secure and never share it.
• id_ed25519.pub (or id_rsa.pub): This is your public key. This is the file you'll copy to your server.

The permissions for these files are also very important for security!

The easiest way to get your public key onto a server is using the ssh-copy-id command. It securely copies your public key to the server's ~/.ssh/authorized_keys file.

You'll need to use your password the first time you run this command for a new server. After that, password login is often no longer needed.

If ssh-copy-id isn't available or you prefer a manual method, you can copy your public key to the server yourself.

First, ensure the ~/.ssh directory exists and has correct permissions (700) on the server. Then, append your public key to the ~/.ssh/authorized_keys file (permissions 600).

Once your public key is on the server, you can connect using SSH. If you used the default key name (e.g., id_rsa or id_ed25519), SSH will automatically find it.

If you used a custom key name (e.g., my_server_key), you'll need to specify it using the -i flag.

For enhanced security, it's highly recommended to disable password authentication on your server once key-based login is working.

Edit the SSH daemon configuration file (/etc/ssh/sshd_config) on the server, change PasswordAuthentication yes to no, and restart the SSH service (e.g., sudo systemctl restart sshd or sudo service ssh restart).

You've learned how SSH key-based authentication works, how to generate keys, and how to deploy them. Let's test your knowledge!

Great job! You've mastered SSH key-based authentication. You learned:

• The difference between public and private keys.
• How to generate key pairs using ssh-keygen.
• How to deploy your public key to a server with ssh-copy-id or manually.
• How to connect securely without passwords.
• Why and how to disable password authentication on your server.

SSH keys are a fundamental tool for secure and efficient server management. Keep practicing!