SSH — Secure SHell
Here is an introduction to ssh mechanics & some step by step commands to connect to a remote server using ssh on Ubuntu machines.
The most common way of connecting to a remote Linux server is through SSH. When you connect through SSH, you log in using an account that exists on the remote server.
To authenticate using SSH keys, a user must have an SSH key pair on their local computer. On the remote server, the public key must be copied to a file within the user’s home directory at ~/.ssh/authorized_keys. This file authorized_keys without any file extension contains a list of public keys, one-per-line, that are authorized to log into this account.
When a client connects to the host, wishing to use SSH key authentication, it will inform the server of this intent and will tell the server which public key to use. The server then checks its authorized_keys file for the public key, generates a random string, and encrypts it using the public key. This encrypted message can only be decrypted with the associated private key. The server will send this encrypted message to the client to test whether they actually have the associated private key.
Upon receipt of this message, the client will decrypt it using the private key and combine the random string that is revealed with a previously negotiated session ID. It then generates an MD5 hash of this value and transmits it back to the server. The server already had the original message and the session ID, so it can compare an MD5 hash generated by those values and determine that the client must have the private key.
RSA keys are generally preferred and are the default key type.
RSA SSH key pair, located in the .ssh hidden directory within your user’s home directory has these files:
~/.ssh/id_rsa: The private key. DO NOT SHARE THIS FILE!
~/.ssh/id_rsa.pub: The associated public key. This can be shared freely without consequence. (digitalocean)
Access a Remote Server (6 Steps)
If you want to access another remote server from your local or source server you must create a new user on that remote host and copy your Public Key from source server to the remote server new user’s file at home directory ~/.ssh/authorized_keys using ssh-copy-id
Note-1: Normally at the time of server creation only PUBLIC KEY is added in authorized_keys file for root user & no id_rsa.pub is created. So if we want to use ssh login from SOURCE or local server we need a pair of Public & Private Keys that’s why we must use ssh-keygen command to generate a pair at SOURCE or local server.
Note-2: ssh-copy-id command only works if you have created a key pair previously using ssh-keygen.
Note-3: id_rsa.pub is a public key that you add to other hosts’ authorized_keys files to allow you to log in as that user. authorized_keys is a list of public keys that are allowed to log into that specific account on that specific server. authorized_keys is used by the daemon to determine whether a key (offered by a connecting client) is allowed to access the host it’s running on.
on SOURCE SERVER (from where we want to connect to remote server)
STEP-1: Generate an SSH Key Pair
ssh-keygen: Display the SSH Key Fingerprint: ssh-keygen -l
Copying your Public SSH Key to a Remote Server
You must first create password-based SSH access on REMOTE Host server by following below mentioned steps:
On the REMOTE Server
STEP-2: CREATE A NEW USER (that will be used to login to this machine from source server)
Create New User:
useradd -m -d /home/newUserName newUserName
passwd newUserName
Add the New User to the Sudo Group: usermod -aG sudo newUserName
STEP-3: Allow This User To Be Connected From Source Machine & Enable Password Authentication
Edit sshd_config of this new user & add following line to allow users from another machine
Get Faisal Mahmood’s stories in your inbox
Join Medium for free to get updates from this writer.
nano /etc/ssh/sshd_config
AllowUsers newUserName@source_server_ip_address
Change no to yes:
PasswordAuthentication yes
PubkeyAuthentication yes
Restart ssh service: service ssh restart
on SOURCE SERVER
STEP-4: Copy Public Key To Remote Server Users Home Directory From Source Server
ssh-copy-id newUserName@remote_host_ip_address
It will ask password of newUserName & will then add public key to home directory.
STEP-5: Login To Remote Server From Source Server Without Password
ssh newUserName@remote_host_ip_address
On the REMOTE Server
STEP-6: On Remote Server Disable Password Authentication
nano /etc/ssh/sshd_config
PasswordAuthentication no
General Useful Commands
Read Stored Public Keys: cat ~/.ssh/id_rsa.pub
Read authorized_keys File: nano .ssh/authorized_keys
All Stored Public Keys: ls ~/.ssh/*.pub
List tunnels created by ssh: sudo lsof -i -n | egrep ‘\<ssh\>’
Check User Home Directory: grep newUserName /etc/passwd
Create User Home Directory If -m & -d not used when creating user: mkhomedir_helper newUserName
Change User to New User: su newUserName
List all Users: cut -d: -f1 /etc/passwd
Change Password: sudo passwd newUserName
Del User: sudo userdel newUserName
