Secure SSH with Key-Based Authentication

Table of Contents

Introduction to SSH and Key-Based Authentication {#introduction}

SSH (Secure Shell) is a cryptographic network protocol that provides secure communication over an unsecured network. Key-based authentication is a more secure alternative to password-based authentication, utilizing public-key cryptography to verify user identity.

Why Use Key-Based Authentication

Key-based authentication offers several advantages over traditional password authentication:

| Advantage | Description | |-----------|-------------| | Enhanced Security | Eliminates brute-force password attacks | | Convenience | No need to remember complex passwords | | Automation | Enables secure automated processes | | Non-repudiation | Provides strong identity verification | | Scalability | Easier management of multiple server access |

How SSH Key Authentication Works

The process involves asymmetric cryptography with a key pair:

1. Key Pair Generation: A public and private key pair is created 2. Public Key Distribution: The public key is placed on the server 3. Authentication Process: The client proves possession of the private key 4. Access Granted: Server verifies the signature and grants access

Understanding SSH Key Types {#ssh-key-types}

SSH supports multiple key algorithms, each with different security characteristics and performance implications.

Supported Key Types

| Algorithm | Key Size | Security Level | Performance | Recommended Use | |-----------|----------|----------------|-------------|-----------------| | RSA | 2048-4096 bits | Good-Excellent | Moderate | General purpose | | ECDSA | 256-521 bits | Good-Excellent | Fast | Modern systems | | Ed25519 | 256 bits | Excellent | Very Fast | Preferred choice | | DSA | 1024 bits | Deprecated | Fast | Legacy systems only |

Algorithm Comparison

RSA (Rivest-Shamir-Adleman) - Most widely supported - Requires larger key sizes for equivalent security - Computationally intensive for large keys

ECDSA (Elliptic Curve Digital Signature Algorithm) - Smaller key sizes with equivalent security - Faster than RSA - Some implementation concerns with certain curves

Ed25519 (Edwards-curve Digital Signature Algorithm) - Based on Curve25519 - Excellent security properties - Fast performance - Resistant to side-channel attacks

SSH Key Generation {#key-generation}

Basic Key Generation

The ssh-keygen command is used to generate SSH key pairs.

#### Generate RSA Key Pair

`bash ssh-keygen -t rsa -b 4096 -C "user@example.com" `

Command Breakdown: - -t rsa: Specifies RSA algorithm - -b 4096: Sets key length to 4096 bits - -C "user@example.com": Adds a comment for identification

#### Generate Ed25519 Key Pair (Recommended)

`bash ssh-keygen -t ed25519 -C "user@example.com" `

Command Breakdown: - -t ed25519: Specifies Ed25519 algorithm - Ed25519 has a fixed key length of 256 bits

#### Generate ECDSA Key Pair

`bash ssh-keygen -t ecdsa -b 521 -C "user@example.com" `

Command Breakdown: - -t ecdsa: Specifies ECDSA algorithm - -b 521: Sets curve size to 521 bits

Advanced Key Generation Options

#### Specify Key File Location

`bash ssh-keygen -t ed25519 -f ~/.ssh/custom_key -C "custom key" `

Notes: - -f ~/.ssh/custom_key: Specifies custom file path - Creates custom_key (private) and custom_key.pub (public)

#### Generate Key with Passphrase

`bash ssh-keygen -t ed25519 -N "strong_passphrase" -f ~/.ssh/secure_key `

Notes: - -N "strong_passphrase": Sets passphrase non-interactively - Passphrase encrypts the private key file

#### Generate Key with Custom Parameters

`bash ssh-keygen -t rsa -b 4096 -f ~/.ssh/server_key -N "" -C "server-$(date +%Y%m%d)" `

Command Breakdown: - -N "": No passphrase (empty string) - -C "server-$(date +%Y%m%d)": Dynamic comment with date

Key Generation Process Flow

` 1. Algorithm Selection ↓ 2. Key Size Determination ↓ 3. File Location Specification ↓ 4. Passphrase Configuration ↓ 5. Key Pair Creation ↓ 6. File Permissions Setting `

SSH Key Management {#key-management}

File Structure and Permissions

SSH keys must have correct permissions for security:

| File Type | Permissions | Owner | Description | |-----------|-------------|-------|-------------| | Private Key | 600 | User only | Read/write for owner only | | Public Key | 644 | User | Read for all, write for owner | | .ssh Directory | 700 | User only | Full access for owner only | | authorized_keys | 600 | User only | Read/write for owner only |

#### Set Correct Permissions

`bash

Set directory permissions

Set private key permissions

Set public key permissions

Set authorized_keys permissions

Key Distribution Methods

#### Method 1: Using ssh-copy-id (Recommended)

`bash ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server.example.com `

Command Breakdown: - -i ~/.ssh/id_ed25519.pub: Specifies public key file - user@server.example.com: Target user and server

#### Method 2: Manual Copy

`bash cat ~/.ssh/id_ed25519.pub | ssh user@server.example.com "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys" `

Process Explanation: 1. Reads local public key 2. Creates remote .ssh directory if needed 3. Appends public key to authorized_keys

#### Method 3: Direct File Transfer

`bash scp ~/.ssh/id_ed25519.pub user@server.example.com:~/temp_key.pub ssh user@server.example.com "cat ~/temp_key.pub >> ~/.ssh/authorized_keys && rm ~/temp_key.pub" `

Multiple Key Management

#### Generate Keys for Different Purposes

`bash

Personal key

Work key

Server administration key

#### SSH Config for Multiple Keys

Create ~/.ssh/config:

`

Personal servers

Work servers

Administrative access

Server Configuration {#server-configuration}

SSH Daemon Configuration

The SSH daemon configuration file is typically located at /etc/ssh/sshd_config.

#### Essential Security Settings

`bash

Backup original configuration

Edit configuration

#### Key-Based Authentication Settings

`

Enable public key authentication

Specify authorized keys file

Disable password authentication (after key setup)

Disable challenge-response authentication

Disable empty passwords

Disable root login (recommended)

Or allow root login with keys only

#### Additional Security Configurations

`

Change default port (security through obscurity)

Limit user access

Or limit by group

Set login grace time

Limit authentication attempts

Set maximum sessions

Disable X11 forwarding if not needed

Disable agent forwarding if not needed

Disable TCP forwarding if not needed

Validate and Restart SSH Service

#### Test Configuration Syntax

`bash sudo sshd -t `

Notes: - Tests configuration file syntax - Reports any errors before applying changes

#### Restart SSH Service

`bash

SystemD systems

SysV systems

Check service status

Advanced Server Configurations

#### Key-Based Authentication with Restrictions

Add restrictions to authorized_keys entries:

`

Restrict by source IP

Restrict to specific command

Disable port forwarding

Multiple restrictions

#### Certificate-Based Authentication

Generate SSH Certificate Authority:

`bash

Generate CA key

Sign user key

Configure server to trust CA:

`

In /etc/ssh/sshd_config

Client Configuration {#client-configuration}

SSH Client Configuration File

The client configuration file ~/.ssh/config allows customization of SSH behavior.

#### Basic Configuration Structure

` Host hostname Option value Option value

Host pattern* Option value `

#### Common Configuration Options

| Option | Description | Example | |--------|-------------|---------| | HostName | Real hostname or IP | HostName 192.168.1.100 | | User | Username for connection | User admin | | Port | SSH port number | Port 2222 | | IdentityFile | Path to private key | IdentityFile ~/.ssh/custom_key | | IdentitiesOnly | Use only specified keys | IdentitiesOnly yes | | ServerAliveInterval | Keep-alive interval | ServerAliveInterval 60 | | ServerAliveCountMax | Max keep-alive attempts | ServerAliveCountMax 3 |

#### Example Client Configuration

`

Default settings for all hosts

Production servers

Development environment

Jump host configuration

Bastion host

SSH Agent Configuration

SSH Agent manages private keys in memory, eliminating the need to enter passphrases repeatedly.

#### Start SSH Agent

`bash

Start agent

Add keys to agent

List loaded keys

Remove specific key

Remove all keys

#### Automatic Agent Startup

Add to ~/.bashrc or ~/.zshrc:

`bash

SSH Agent auto-start

Connection Testing and Debugging

#### Test SSH Connection

`bash

Basic connection test

Verbose connection (debug level 1)

Very verbose (debug level 3)

Test with specific key

Test configuration

Advanced Security Configurations {#advanced-security}

Multi-Factor Authentication

Combine key-based authentication with additional factors for enhanced security.

#### TOTP Integration

Install and configure Google Authenticator PAM module:

`bash

Install PAM module

Configure for user

Configure SSH to require both key and TOTP:

`

In /etc/ssh/sshd_config

In /etc/pam.d/sshd

SSH Key Rotation

Regular key rotation enhances security by limiting exposure time.

#### Automated Key Rotation Script

`bash #!/bin/bash

ssh_key_rotation.sh

KEY_TYPE="ed25519" KEY_PATH="$HOME/.ssh" BACKUP_PATH="$HOME/.ssh/backup" SERVERS_FILE="$HOME/.ssh/servers.txt"

Create backup directory

Generate new key pair

Distribute new public key

Backup old keys

Install new keys

Set correct permissions

echo "Key rotation completed" `

Network Security Enhancements

#### Port Knocking

Implement port knocking for additional security:

`bash

Install knockd

Configure /etc/knockd.conf

[openSSH] sequence = 7000,8000,9000 seq_timeout = 5 command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn

[closeSSH] sequence = 9000,8000,7000 seq_timeout = 5 command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn `

Client usage:

`bash

Knock to open SSH port

Connect via SSH

Knock to close SSH port

#### VPN Integration

Combine SSH with VPN for layered security:

`bash

OpenVPN configuration example

In SSH config

Troubleshooting {#troubleshooting}

Common Issues and Solutions

#### Permission Problems

Issue: SSH key authentication fails due to incorrect permissions.

Diagnosis: `bash ls -la ~/.ssh/ `

Solution: `bash chmod 700 ~/.ssh chmod 600 ~/.ssh/id_ed25519 chmod 644 ~/.ssh/id_ed25519.pub chmod 600 ~/.ssh/authorized_keys `

#### Key Not Found

Issue: SSH cannot find the private key.

Diagnosis: `bash ssh-add -l ssh -vvv user@server.example.com `

Solution: `bash

Add key to agent

Or specify key explicitly

#### Server Configuration Issues

Issue: Server rejects key authentication.

Diagnosis: `bash

Check server logs

Test SSH daemon configuration

Common Solutions: `bash

Ensure PubkeyAuthentication is enabled

Check authorized_keys file location

Verify SELinux contexts (if applicable)

Debug Information Analysis

#### SSH Client Debug Output

`bash ssh -vvv user@server.example.com `

Key Debug Messages:

| Message | Meaning | |---------|---------| | debug1: Offering RSA public key | Client offers key for authentication | | debug1: Server accepts key | Server accepts the offered key | | debug1: Authentication succeeded | Key authentication successful | | debug1: key_load_public: No such file | Public key file not found |

#### SSH Server Debug Mode

`bash

Run SSH daemon in debug mode

Notes: - -d: Debug mode - -p 2223: Use alternative port - Provides detailed authentication process information

Recovery Procedures

#### Locked Out Recovery

If key authentication fails and password authentication is disabled:

1. Physical Access Method: `bash # Access server console directly # Edit /etc/ssh/sshd_config sudo nano /etc/ssh/sshd_config # Temporarily enable password authentication PasswordAuthentication yes # Restart SSH service sudo systemctl restart sshd `

2. Alternative User Method: `bash # Use different user account with access ssh alternate_user@server.example.com # Fix primary user's SSH configuration sudo -u primary_user bash chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys `

Best Practices {#best-practices}

Security Best Practices

#### Key Management Guidelines

| Practice | Description | Implementation | |----------|-------------|----------------| | Use Strong Keys | Prefer Ed25519 or RSA 4096-bit | ssh-keygen -t ed25519 | | Protect Private Keys | Use passphrases and secure storage | ssh-keygen -N "passphrase" | | Regular Rotation | Rotate keys periodically | Automated rotation scripts | | Principle of Least Privilege | Limit key access scope | Restricted authorized_keys | | Audit Key Usage | Monitor and log key usage | Centralized logging |

#### Server Hardening Checklist

`bash

1. Disable password authentication

2. Disable root login

3. Change default port

4. Limit login attempts

5. Set idle timeout

6. Disable unused features

7. Restart SSH service

Operational Best Practices

#### Documentation Standards

Maintain comprehensive documentation:

` SSH Key Inventory: - Key ID: admin_ed25519_20240101 - Algorithm: Ed25519 - Created: 2024-01-01 - Purpose: Server administration - Servers: prod-web-01, prod-db-01 - Expiration: 2024-12-31 - Contact: admin@company.com `

#### Backup Procedures

`bash #!/bin/bash

SSH key backup script

BACKUP_DIR="/secure/backup/ssh-keys/$(date +%Y%m%d)" SSH_DIR="$HOME/.ssh"

Create backup directory

Backup SSH directory

Encrypt backup

Remove unencrypted backup

echo "SSH key backup completed: $BACKUP_DIR" `

Monitoring and Auditing {#monitoring}

SSH Connection Monitoring

#### Log Analysis

SSH connections are typically logged to /var/log/auth.log or /var/log/secure.

Important Log Entries:

`bash

Successful key authentication

Failed authentication attempts

Connection summaries

#### Real-time Monitoring

`bash

Monitor SSH connections in real-time

Monitor specific user connections

Monitor failed attempts

Automated Security Monitoring

#### SSH Monitoring Script

`bash #!/bin/bash

ssh_monitor.sh

LOG_FILE="/var/log/auth.log" ALERT_EMAIL="security@company.com" THRESHOLD=5

Count failed attempts in last hour

if [ "$FAILED_ATTEMPTS" -gt "$THRESHOLD" ]; then echo "ALERT: $FAILED_ATTEMPTS failed SSH attempts in the last hour" | \ mail -s "SSH Security Alert" "$ALERT_EMAIL" fi

Generate daily summary

Compliance and Auditing

#### SSH Configuration Audit

`bash #!/bin/bash

ssh_audit.sh

CONFIG_FILE="/etc/ssh/sshd_config" REPORT_FILE="/tmp/ssh_audit_$(date +%Y%m%d).txt"

{ echo "SSH Security Configuration Audit - $(date)" echo "=============================================" # Check critical security settings echo "Password Authentication: $(grep "^PasswordAuthentication" "$CONFIG_FILE" || echo "NOT SET")" echo "Root Login: $(grep "^PermitRootLogin" "$CONFIG_FILE" || echo "NOT SET")" echo "Public Key Authentication: $(grep "^PubkeyAuthentication" "$CONFIG_FILE" || echo "NOT SET")" echo "SSH Port: $(grep "^Port" "$CONFIG_FILE" || echo "Default (22)")" echo "Max Auth Tries: $(grep "^MaxAuthTries" "$CONFIG_FILE" || echo "NOT SET")" # Check key algorithms echo "" echo "Supported Key Algorithms:" ssh -Q key # Check active connections echo "" echo "Current SSH Sessions:" who | grep pts } > "$REPORT_FILE"

echo "Audit report generated: $REPORT_FILE" `

This comprehensive guide provides a complete foundation for implementing secure SSH with key-based authentication. The configuration examples, security practices, and monitoring procedures ensure robust protection while maintaining operational efficiency. Regular review and updates of these configurations will help maintain security effectiveness as threats evolve.