0

I have a VPS with CentOS 6. I've noticed a lot of login attempts via SSH, so I want to lock it down with key based authentication. Here is what I have done so far....

Ran the following on my client machine (OSX)

ssh-keygen -t rsa

Did this with default settings (no passphrase, default names, etc)

Set the following permissions on my client

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa

copied my public key to the root of my userfolder on my VPS using the following command (fake name/ip)

scp id_rsa.pub fakeuser@255.255.255.255:/home/fakeuser/id_rsa.pub

Here I noticed that I did NOT have an authorized_keys file within my .ssh. So I used touch to create it. Then I used CAT to copy the contents of the .pub into the authorized_keys file

cat id_rsa.pub >> ~/.ssh/authorized_keys

and set the appropriate permissions on .ssh and authorized_keys

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

In /etc/ssh/sshd_config I uncommented the following

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

I then restarted sshd

service sshd restart

From what I read, this is all I should have to do to enable public key authentication. However, when I attempt to SSH without supplying -i privatekey, I am allowed in from all devices.

  • Just as a followup... I tried to copy the key using ssh-copy-id root@IPADDRESS and it shows 1 key was copied. I can log in without needing to supply my password, however from other devices that do not have the private key, I can connect as well. – Barbados Slim Dec 4 '17 at 14:55
  • Be aware that these login attempts you're seeing are all just automated bots scanning through the entire internet looking for easy to capture, vulnerable servers. The only way to protect against that is not having an SSH server at all, or at least not on port 22. If you don't use default passwords that are found in a list, you should be pretty safe though (pi:raspberry anyone?) - but it's definitely better to not allow passwords at all for SSH. – Wüstengecko Nov 4 '18 at 5:44
2

If a client key is in the default location ~/.ssh/id_$alg it is used automatically unless you use -o IdentitiesOnly=yes (or the equivalent config file entry) to disable it. If you are able to connect from a client that does not have a copy of the privatekey and without specifying a password, then the authentication on your server is not set correctly. If you want to use only privatekey->publickey authentication, configure PasswordAuthentication no .

PS: anything >>file (and anything >file also) creates the file if it doesn't exist, you don't need to touch it. And the default remote dir for scp is your homedir, so you normally don't need to specify that.

Also:

RSAAuthentication is for SSHv1 which was broken decades ago and should never be used and is disabled by default in all OpenSSH versions for a long time and removed entirely from server side as of 7.4 although I expect CentOS 6 probably does not have that recent a version.

PubkeyAuthentication yes and AuthorizedKeysFile .ssh/authorized_keys (plus authorized_keys2 which is a relic and no longer used) are the defaults so you don't actually need to uncomment them.

  • Thank you for taking the time to respond. I'm not 100% if IdentitiesOnly=yes is enabled... I can not see that within my sshd_config file, unless that is an option associated with the creation of the key pair. If so, I did not use that when creating the pair. I tried to move the public key to ~/.ssh/, currently sitting beside the authorized_keys file I created earlier and i'm still stuck. I do have passwords enabled, I'm just trying to do both certificate based authentication and password. – Barbados Slim Dec 2 '17 at 20:25
0

You need to explicitly disable password authentication on the server if you only want to allow public/private keys. In your /etc/ssh/sshd_config change or add the setting:

PasswordAuthentication no

I also like to explicitly disable all other types of authentication that I don't use, like Kerberos and GSSAPI.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.