Setting Up SSH Public Key Authentication on Ubuntu
This guide explains how to set up SSH public key authentication on an Ubuntu server from a Windows 10 client, eliminating the need for password-based logins. It covers installing OpenSSH, generating key pairs, deploying public keys, configuring SSHD settings, and managing root access. Ensuring proper file permissions is also discussed for optimal security.
Working with remote servers is a routine task for system administrators, and SSH (Secure Shell) is commonly used for secure access. Instead of entering a password every time, you can set up SSH public key authentication, allowing for password-less logins while enhancing security. This guide walks you through the steps to configure SSH public key authentication on an Ubuntu server from a Windows 10 client.
Environment Setup
For this setup, we use a Windows 10 computer with OpenSSH installed and a virtual Ubuntu server on the same local network. We will generate the SSH key pair using Windows OpenSSH. Other SSH clients like PuTTY can also be used, but this guide does not cover PuTTY key generation.
Installing OpenSSH on Windows
If your Windows version is from 2018 or later, OpenSSH might already be installed. If not, install it via the Apps & Features menu:
- Go to Settings > Apps > Optional features.
- Click Add a feature and search for OpenSSH.
- Install it and reboot your system if necessary.
Alternatively, use PowerShell with the command:
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
Generating the SSH Key Pair
To generate an SSH key pair on Windows, open Command Prompt and type:
ssh-keygen
By default, this creates a 3072-bit RSA key pair. For enhanced security, use:
ssh-keygen -t ed25519
The -t option specifies the encryption algorithm. Ed25519 is recommended for production environments.
After running the command, you’ll be prompted to specify a file location and passphrase. For this lab, you can accept the default location and leave the passphrase empty. In production, setting a passphrase is advisable for added security.
Deploying Your Public Key to the Ubuntu Server
- Connect to your Ubuntu server via SSH:
ssh username@ip_address
- On the server, navigate to the .ssh directory and open or create the authorized_keys file:
cd ~/.ssh
nano authorized_keys
- Copy the content of your Windows id_rsa.pub file into authorized_keys. The content will look like:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD9WvpJ7Zkig0cCDf46sby/muo3JFqdADSbjhFW4rI0paeF0X8ujL4Iu/I+BQxtfW8kSyBpgslt0NcM78RxrxB1Be+/zFa5UTRwR3sa6CcDWsT7xh3IX4lrC/LtXwyeE3GLT8VVlcsqv2O6gcTxF97Lcyb8U4RCdVBBqCoNH64T60O8Sn9Sr5pD2XZl0a9gQtpKdpobrIBLnMwDA4yBlly6vCRSU+mWX+U94GJ26M8tlQMF/YPR5uoLUY5LCUOPilvvLzDCWsJM9iBZyf4BjtX/n42XH6pNyxQLJ9TTdwNNDZMTEKmZ8u6rO1RMTYRTDBJR2mpi54n5Vw4bZQufPuGI/yxMLEGNlNqpuY/rg8QVz7oHlcraxuqqMM2ZfWtrPQReaPyQq1Dz/5l3dkzy/2JDoELsTgaaVJyxbPb5ZTTBluCTJKQMt4prS0WC1ZO/iThrbmfweYqz1jjRdhRSN4TVU7cDNRro3CdJ11/cBFqzQPpKMNgL3dlBimvoYXyH1qM= username@unserComputerName
- Save and exit the file.
Configuring sshd
- Edit the SSH configuration file:
sudo nano /etc/ssh/sshd_config
- Ensure the following settings are enabled:
shell
Copy code
PubkeyAuthentication yes
PasswordAuthentication no
- Make a backup of the configuration file before making changes. Restart the SSH service or reboot the server to apply the changes. Avoid restarting the service while logged in; instead, open a new session if necessary.
Configuring Root Authentication
To allow root login without a password:
- Switch to root:
sudo su
- Navigate to the root home directory:
cd /root/.ssh
- Add your public key to
authorized_keysand restart the SSH service.
Notes on File Permissions
For maximum security, ensure .ssh folder permissions are set to 700 and authorized_keys file permissions are set to 600. Adjusting permissions beyond these settings may cause security issues.