Secure SSH Key Setup and Permissions

Secure Shell (SSH) is a fundamental protocol for securely accessing remote servers. A critical component of secure SSH access is the use of key pairs – a private key kept secret on your local machine and a public key placed on the remote server. This tutorial will guide you through the proper setup and, crucially, the correct permissions needed for your SSH keys to function securely and reliably.

Understanding SSH Key Pairs

SSH key pairs offer a more secure alternative to password-based authentication. When you attempt to connect to a server, the SSH client uses your private key to prove your identity. The server verifies this proof using the corresponding public key that you’ve previously installed on the server.

Generating an SSH Key Pair

If you haven’t already, generate an SSH key pair using the ssh-keygen command. Open your terminal and run:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/my_ssh_key

Let’s break down this command:

ssh-keygen: The command to generate SSH keys.
-t rsa: Specifies the RSA algorithm for key generation. RSA is a widely used and secure algorithm.
-b 4096: Sets the key size to 4096 bits. Larger key sizes are generally more secure.
-f ~/.ssh/my_ssh_key: Specifies the filename and location to save the key pair. This will create two files: ~/.ssh/my_ssh_key (the private key) and ~/.ssh/my_ssh_key.pub (the public key). You can choose any descriptive name for your key.

You will be prompted for a passphrase. While optional, using a passphrase adds an extra layer of security. If your private key is compromised, an attacker would also need the passphrase to use it.

Installing the Public Key on the Server

Once the key pair is generated, you need to place the public key on the remote server. There are several ways to do this. A common method is to use the ssh-copy-id command:

ssh-copy-id -i ~/.ssh/my_ssh_key.pub user@remote_host

Replace user with your username on the remote server and remote_host with the server’s hostname or IP address. You may be prompted for your password on the remote server to authorize the key installation.

Alternatively, you can manually copy the contents of ~/.ssh/my_ssh_key.pub and append it to the ~/.ssh/authorized_keys file on the remote server. Ensure the ~/.ssh directory exists and has the correct permissions (see below).

Essential File Permissions

This is the most critical part. Incorrect permissions are the most common cause of SSH authentication failures.

Private Key (~/.ssh/my_ssh_key): The private key must be readable only by you. This is paramount for security. Set the permissions using:
```
chmod 400 ~/.ssh/my_ssh_key
```
This sets the permissions to r-------- (read only for the owner). Any other permissions will be rejected by SSH.
Public Key (~/.ssh/my_ssh_key.pub): The public key can be readable by anyone, as it’s meant to be shared.
.ssh Directory: The .ssh directory itself should have permissions 700 (read, write, and execute for the owner only):
```
chmod 700 ~/.ssh
```
authorized_keys File: The authorized_keys file, which stores the public keys authorized to access the server, should have permissions 600 (read and write for the owner only):
```
chmod 600 ~/.ssh/authorized_keys
```

Configuring SSH Client (Optional)

You can configure your SSH client to automatically use the correct private key when connecting to a specific host. Edit or create the ~/.ssh/config file and add a section like this:

Host my_remote_server
  Hostname remote_host_ip_or_domain
  User your_username
  IdentityFile ~/.ssh/my_ssh_key

Replace my_remote_server, remote_host_ip_or_domain, your_username, and ~/.ssh/my_ssh_key with your specific values.

Troubleshooting

If you’re still experiencing issues, here are some things to check:

Permissions: Double-check that all the permissions are set correctly.
Key Location: Ensure you’re pointing to the correct private key file.
authorized_keys Content: Verify that the public key in ~/.ssh/authorized_keys on the server matches the public key generated on your local machine.
SSH Server Configuration: Check the SSH server configuration file (/etc/ssh/sshd_config) to ensure that public key authentication is enabled and that there are no restrictions preventing you from connecting.

By following these guidelines, you can establish a secure and reliable SSH connection to your remote servers.