mrvitej.in

Archive · Linux

SSH Keys and a Safer sshd

Replace passwords with keys and switch off the risky defaults.

1 min read

  • Ubuntu 18.04.3 LTS
  • OpenSSH 7.6
  • CentOS 7.7
  • OpenSSH 7.4

Key-based login is stronger than any password. On your own machine:

ssh-keygen -t ed25519 -C "raviteja-laptop"
ssh-copy-id deploy@server
ssh deploy@server

Ed25519 keys are supported by OpenSSH 6.5 and later, so both Ubuntu 18.04 (7.6) and CentOS 7 (7.4) accept them.

Once key login works, tighten /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3

Validate with sudo sshd -t, then sudo systemctl reload ssh (the service is sshd on CentOS). Keep your current session open and test a second login before closing it, so a typo cannot lock you out. Add fail2ban to ban repeated failed attempts.