notes/Setting up SSH keys.md

#documentation

Terms

The following terms should be standardized across the document.

Client

• The user side local computer that connects to a remote host, typically a server.
• This side has the private key, which you should keep secure
• The private key decrypts data

Server

• The remote computer that the client connects to.
• This side has the public key, which doesn't need to be secure
• The public key encrypts data

SSH Keypairs

SSH keypair authentication relies on asymmetrical encryption, and is only used for authentication. Once they exchange the needed info, they use the Diffie-Hellman Key Exchange Algorithm to create a symmetrical key(can decrypt and encrypt). This is used to encrypt the rest of the session.

Setup

1. Generate an SSH keypair from the client with:

   ssh-keygen -t ed25519
   

• Note: while ed25519 encryption is much more secure than rsa4096, it's not universally supported. When using older versions of OpenSSH, generate a key with ssh-keygen -t rsa -b 4096 to generate an rsa4096 keypair. This should be compatible with almost every implementation of SSH.

2. Follow the prompts onscreen:
   • You will be asked where to save the key, the default location is typically correct(~/.ssh/KEYNAME) where KEYNAME is the name of your keypair.
   • You will then be prompted for a password. This password is used alongside the keypair, and is optional(leave blank if you want passwordless login)
3. Copying the public key to the server

• There should now be two files in ~/.ssh with the format id_ENCRYPTIONMETHOD and id_ENCRYPTIONMETHOD.pub (EG: id_ed25519 and id_ed25519.pub)

ssh-copy-id USERNAME@SERVERADDRESS

• EG: ssh-copy-id foo@192.168.0.10
• Restart the SSH daemon, and test for functionality

Further Configuration

Disabling password based login

1. Edit /etc/ssh/sshd_config to have an uncommented line that says:

   PasswordAuthenntication no

• This will prevent clients from logging on with a password entirely, unless the SSH key was configured with a passcode.
• Reload the SSH daemon.

Storing keys on github

1. See https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account about adding keys, access public keys at https://github.com/USERNAME.keys
   • You can then add public keys to your server with curl https://github.com/USERNAME.keys | tee -a ~/.ssh/authorized_keys
   • A similar method should exist across most git clients.

---

Further Reading

• https://www.hostinger.com/tutorials/ssh
• https://www.hostinger.com/tutorials/ssh-tutorial-how-does-ssh-work
• https://www.digitalocean.com/community/tutorials/ssh-essentials-working-with-ssh-servers-clients-and-keys