Securing Your Server (Part 1): Connecting to a Linux Server via SSH Keys | O's World

When connecting to a Linux server, the default method is using password authentication. This has obvious drawbacks: simple passwords are easily cracked, while complex passwords are difficult to remember and type, making it highly inconvenient.

Therefore, logging in using SSH keys has become a safer, more efficient recommended solution. Through key-based authentication, not only do we avoid the trouble of remembering and typing tedious passwords, but we also greatly enhance server security, effectively defending against unauthorized access attempts.

We will use the Ed25519 key format, which has a cleaner public key and is a more modern and secure encryption algorithm than RSA.

Step 1: Generate SSH Key Pair

First, generate a pair of SSH keys on your local computer:

1. Open your terminal and run the following command:

ssh-keygen -t ed25519 -C "[email protected]"

• -t ed25519：Specifies the key type as Ed25519.
• -C "[email protected]"：Adds a comment to your key, making it easy to identify later.

2. Once the command runs, it will prompt you for a filename (path) to save the key. Enter a name or press Enter to accept the default.

Enter file in which to save the key (/home/your_username/.ssh/id_ed25519):

3. Next, the program will prompt you to enter a passphrase. Choose whether to set a password for the private key, or press Enter to proceed without a password.

Enter passphrase (empty for no passphrase):
Enter same passphrase again:

4. Once successfully generated, you will see output similar to the following:

Your identification has been saved in /home/your_username/.ssh/id_ed25519
Your public key has been saved in /home/your_username/.ssh/id_ed25519.pub

At this point, two files are generated in the ~/.ssh/ directory:

• id_ed25519：Private key, which must be kept secure. Never expose it to anyone.
• id_ed25519.pub：Public key, which can be safely shared with others or uploaded to servers.

Step 2: Upload the Public Key to the Server

Now that we have generated the key pair, the next step is to copy the public key to your Linux server.

1. Using the ssh-copy-id command (Recommended)
   This is the simplest method. It automatically copies your public key into the server's ~/.ssh/authorized_keys file and applies the correct file permissions.

   Simply run the following command:

   ssh-copy-id -i ~/.ssh/id_ed25519.pub username@server_ip

   The program will prompt you to enter the server's password. Once entered, the public key will be uploaded automatically.

2. Manual Copying
   If ssh-copy-id is unavailable or password login is already disabled, we can add it manually.

   First, run the following command in your local terminal to view and copy the public key content:

   cat ~/.ssh/id_ed25519.pub

   Then, log in to the server's terminal via Web Console. Create the .ssh directory on the server (if it doesn't exist) and set the correct permissions:

   mkdir -p ~/.ssh
   chmod 700 ~/.ssh

   Next, open or create the authorized_keys file:

   vim ~/.ssh/authorized_keys

   Paste the public key content you just copied from your local machine into the file, then save and exit.

   echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... [email protected]" >> ~/.ssh/authorized_keys

   Finally, set the permissions of the authorized_keys file to 600:

   chmod 600 ~/.ssh/authorized_keys

Step 3: Test Key-based Login

Try logging in to the server using the key from your local terminal:

ssh username@server_ip

If you changed the file name and did not use the default id_ed25519, you must specify the path to the private key manually:

ssh username@server_ip -i ~/.ssh/your_private_key

If you log in successfully, the configuration is working.

Step 4: Disable Password Login

To further improve server security, we should disable password authentication and only allow key-based logins.

1. Log in to your server using the SSH key.

2. Backup the original configuration before modifying it:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

3. Open the SSH configuration file with your preferred editor:

sudo vim /etc/ssh/sshd_config

4. Find the following line in the file and modify its value:
   Find PasswordAuthentication yes and change it to no.

   If you need to modify the SSH port, locate Port 22 and change it to another port.

5. Save and exit the file.

6. Restart the SSH service to apply the changes:

   sudo systemctl restart sshd

   If you modified the SSH port, make sure to open a new terminal window to test if you can connect successfully before disconnecting the current session.

7. Try logging in to the server using a password to verify if login is indeed disabled.

Step 5: Manage Connections Using the ~/.ssh/config File

If your private key file name is not the default, or if you changed the SSH port number, you will need to specify the path or port number manually every time you connect.

This is highly inconvenient. We can use the ~/.ssh/config file to manage connection details. It allows you to define aliases and specific connection options for each server.

1. Create or open the ~/.ssh/config file on your local computer.

2. Add a configuration for your server, for example:

   # 服务器1配置 
   Host myserver
       HostName 192.168.1.100              # 你的服务器 IP 地址或域名
       User username                       # 你的用户名
       Port 2222                           # SSH 端口（如果不是 default 的 22）
       IdentityFile ~/.ssh/id_ed25519      # 指定密钥文件路径
   
   # 服务器2配置
   Host webserver
       HostName example.com
       User webuser
       Port 2222
       IdentityFile ~/.ssh/webserver_key

   The Host field defines the connection alias, which can be named whatever you like.

3. After saving, you can connect to the server using the alias:

   ssh myserver
   
   ssh webserver

Troubleshooting

Common issues are usually related to file permissions.

Common Checks

# 检查.ssh目录权限
ls -l ~/.ssh/

# 检查密钥权限
ls -l ~/.ssh/id_ed25519*

# 检查authorized_keys权限
ls -l ~/.ssh/authorized_keys

Correct Permission Settings

• ~/.ssh/ directory: 700 (drwx——)
• ~/.ssh/id_ed25519 private key: 600 (-rw——-)
• ~/.ssh/authorized_keys: 600 (-rw——-)
• ~/.ssh/config: 600 (-rw——-)

SSH Debugging Mode

# 使用详细模式连接，查看详细信息
ssh -vvv username@server-ip