SSH

Autologin and key based authentication

Prefer in order algorithms (highest first):

• ed25519
• ecdsa
• rsa
• dsa

Prefer lengths in bits, even when some algorithms suggest shorter:

• 4096

On the server side:

mkdir ~/.ssh
chmod 700 ~/.ssh
chown -R "$USER:$USER" ~/.ssh

On the client side on the password request, enter password or just press Enter to make auto login:

cd ~/.ssh
ssh-keygen -t ed25519 -b 4096 -C "e@mail.domain"
# Or without questions
#ssh-keygen -t ed25519 -b 4096 -C "e@mail.domain" -N "" -f ~/.ssh/id_ed25519

Change private key access:

cd ~/.ssh
chmod 600 id_ed25519

Append a public key to authorized_keys:

cd ~/.ssh
cat id_ed25519.pub >> authorized_keys
chmod 600 authorized_keys

Copy authorized_keys to the server side:

cd ~/.ssh
scp authorized_keys ${REMOTE_USER}@${REMOTE_MACHINE}:~/.ssh

Or on the client side:

mkdir ~/bin
nano ~/bin/key.gen.sh

Content:

#!/bin/sh

SSH_DIR=~/.ssh
ARCHIVE_DIR=${SSH_DIR}/archive
TYPE=dsa
TYPE=rsa
TYPE=ed25519
EMAIL=imre.tabur@mail.ee
BITS=4096
SYSTEM=github

REMOTE_USER=
REMOTE_MACHINE=

COPY_TO_REMOTE=yes
COPY_TO_REMOTE=no

genKey() {
    mkdir -p ${ARCHIVE_DIR}
    chmod 700 ${SSH_DIR}
    ssh-keygen -t ${TYPE} -b ${BITS} -C "${EMAIL}" -f ${ARCHIVE_DIR}/id_${TYPE}.${SYSTEM}
    chmod 600 ${ARCHIVE_DIR}/id_${TYPE}.${SYSTEM}
    cp ${ARCHIVE_DIR}/id_${TYPE}.${SYSTEM} ${SSH_DIR}/id_${TYPE}
    cp ${ARCHIVE_DIR}/id_${TYPE}.${SYSTEM}.pub ${SSH_DIR}/id_${TYPE}.pub
}

makeAuth() {
    cat ${ARCHIVE_DIR}/id_${TYPE}.${SYSTEM}.pub >> ${SSH_DIR}/authorized_keys
    chmod 600 ${SSH_DIR}/authorized_keys
}

echoKey() {
    echo "Copy that key to another system:"
    cat ${ARCHIVE_DIR}/id_${TYPE}.${SYSTEM}.pub
}

copyKey() {
    if [ "${COPY_TO_REMOTE}" == "yes" ]
    then
        scp ${SSH_DIR}/authorized_keys ${REMOTE_USER}@${REMOTE_MACHINE}:~/.ssh
    fi
}

genKey
makeAuth
echoKey
copyKey

exit 0

Change key file password

ssh-keygen -p -f ~/.ssh/id_rsa
ssh-keygen -p -f ~/.ssh/id_ed25519

Tips and tricks

Hardening

sudo nano /etc/ssh/sshd_config.d/10-port.conf

Port 12345
#Port 22

sshd -T | grep '^port '
semanage port -a -t ssh_port_t -p tcp 12345
semanage port -l | grep ssh_port_t

sudo groupadd sshusers
sudo usermod -aG sshusers SOMEUSER
sudo id SOMEUSER

sudo nano /etc/ssh/sshd_config.d/20-hardening.conf

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
AllowGroups sshusers
MaxAuthTries 3
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
ClientAliveInterval 300
ClientAliveCountMax 2

sshd -T | grep permitrootlogin
sshd -T | grep passwordauthentication
sshd -T | grep kbdinteractiveauthentication
sshd -T | grep pubkeyauthentication
sshd -T | grep permitemptypasswords

sudo sshd -t
sudo sshd -T | grep -E \
'^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|permitemptypasswords|allowgroups|maxauthtries|x11forwarding|allowagentforwarding|allowtcpforwarding|clientaliveinterval|clientalivecountmax)'