08PassPhraseSSH - amagerard/TemplateVM GitHub Wiki

RedHat/TemplateVM.

1- Installation 2- Network 3- Firewall 4- Selinux
5- Logs 6- Certificates 7- Mail 8- PassphraseSSH
9- Sudo 10- GnomeShell 11- CloneVM 12- Volume
13- Troubleshoot

8. SSH access with passphrase.

8.1 principle.

The ssh connection from the remote server will only be done by passphrase provided that:

  • the administrator of the remote server has created an account for you.
  • your public key is saved in the /home/<username>/.ssh/authorized_keys remote server.
  • your private key is installed in /home/<username>/.ssh your machine.

8.2 Creation of Keys.

Your machine is a Unix system (Ubuntu, Debian, RedHat, freebsd, Mac …).
For Macs, the home directory is /Users/<username>.
Open a terminal on your machine (not from the remote server).
Your session <username> (no root , no sudo).
mkdir /home/<username>/.ssh
If you already have in /home/<username>/.ssh the id_rsa and id_rsa.pub files,
I advise you to make a copy.
ssh-keygen -t rsa  -b 4096 -C <username>@<domain>

Enter file in which to save the key (/home/teacher/.ssh/id_rsa):  
Enter passphrase (empty for no passphrase): Mag6@ndm&re  

You must not forget your passphrase.
ls –la /home/<username>/.ssh
id_rsa —> private.
id_rsa.pub —> public.

8.3 Copy of Public Key.

Copy the contents of your public key to the /home/<username>/.ssh/authorized_keys
remote server file authorizing the ssh connection.
This command makes it easier for you to transfer the copy.
ssh-copy-id -i ~/.ssh/id_rsa.pub <username>@<ipaddress remote server>

On the remote server, check if the public key is present.
cat /home/<username>/.ssh/authorized_keys

Remote server root session.
chmod 700 /home/<username>/.ssh
chmod 600 /home/<username>/.ssh/authorized_keys

Session <username>of your machine:
chmod 700 /home/<username>/.ssh
chmod 600 /home/<username>/.ssh/*

Keep copies of your public and private keys in a safe and not on your machine.

8.4 Configuring ssh on the remote server.

Root session of the remote machine:
Configuration of /etc/ssh/sshd_config on the remote machine.
vi /etc/ssh/sshd_config

#modify or add  
Port 22  
StrictModes yes  
PermitRootLogin no  
AllowUsers <username>  
PubkeyAuthentication yes  
AuthorizedKeysFile      .ssh/authorized_keys  
PasswordAuthentication no  
PermitEmptyPasswords no  

Configuring /etc/sshd_config.d/50-redhat.conf.
vi /etc/ssh/sshd_config.d/50-redhat.conf

ChallengeResponseAuthentication no  
GSSAPIAuthentication yes  
GSSAPICleanupCredentials no  
X11Forwarding yes  
UsePAM yes  
PrintMotd no  

Restart the ssh service.
systemctl restart sshd

8.5 Ssh access to the remote server.

To access the remote server: ssh <username>@<serveur distant>.
Passphrase password <obligatoire>.

8.6 Create an ed25519 type key (more secure).

Open a terminal on your machine (not from the remote server).
Your session (no root , no sudo).

ssh-keygen -o -a 256 -t ed25519 -C <username>@<domain>
id_ed25519 —> private.
id_ed25519.pub —> public.

Repeat the same procedure (chapter 8.3) to export the key to the /home/<username>/.ssh/authorized_keys the remote machine.
ssh-copy-id -i ~/.ssh/id_ed25519.pub <username>@<ipaddress remote server>

8.7 Rejection of Connection.

The connection may be rejected and the solution is to empty the content /home/<username>/.ssh/known_hosts.
> /home/<username>/.ssh/known_hosts

8.8 Ssh access from a windows machine.

The easiest solution.

  • You have a private and public key.
  • On Windows, download PUTTYgen and Putty-installer from https://www.putty.org/.
  • Open PUTTYgen —> conversion —> import your private key.
  • Save the private key in ppk format.
  • Launch Putty. Go to Connection, SSH, Auth and Credentials.
  • Put only the private key in ppk format.

If you don't have a private key.
Putty can create it, but it will take some patience to format the public key into an acceptable format.
https://www.tutos.eu/3194 gives you the procedure.

Tip: start your machine with a “live almalinux” bootable key and create your keys.

⚠️ **GitHub.com Fallback** ⚠️