Information for my Clients
This information is here for my clients to use.
If I am managing, maintaining, or otherwise working on your server without physically being in the same room with it, I will almost certainly be using SSH to access the server.
Please do not ask me to use a password to SSH into your server. This is horribly insecure. If using a password is truly the only option, the first thing I'm going to do is configure the machine to support authentication via SSH keys, using the process shown below.
In order to allow me to remotely access your server via SSH, you first need to make sure that sshd (the program which handles incoming SSH requests) allows logins with public keys. Check and/or edit your /etc/ssh/sshd_config file. You need to make sure it has the following entries:
PubkeyAuthentication
yes
This line may be missing or commented out. The default is "yes", so this should be okay. The important thing is that it cannot be "no".
AuthorizedKeysFile
.ssh/authorized_keys
Some really old versions of OpenSSH used the filename .ssh/authorized_keys2 instead. If yours is one of them (i.e. if this line already exists and has the filename with a 2 at the end), that's fine, but you'll need to use the correct filename when installing my key (below.
AllowUsers
If this line exists and is un-commented in your sshd_config file, it will be followed by a list of usernames. If you want me to SSH in as a non-root user, make sure that user is listed.
In addition, if the userid you wish me to log into is "root", you will need to check this line as well:
PermitRootLogin
without-password
Note that you could also have "yes" here, although it's not as secure. The difference is that "without-password" means that root is allowed to log in, but only if they use an authentication method other than "password". This way if somebody happens to find out what your root password is, they can't use it to ssh into your machine.
I know the phrase "without-password" can be a bit misleading. You should type "man ssh_config" to read more abut this option.
If you had to change the /etc/ssh/sshd_config file, you will need to restart sshd. This is usually done with a command like one of these...
- systemctl restart sshd
- service sshd restart
- /etc/init.d/sshd restart
Note that if the command returns an error message, do not ignore it. If there's a typo in your /etc/ssh/sshd_config file, it can prevent sshd from starting, which would mean that nobody could log into the server remotely - not even yourself.
Adding my ssh public key
After checking the configuration of sshd, you will need to add my current ssh public key to the ".ssh/authorized_keys" file within the home directory of the user you wish me to access. This example shows how to set it up. Note that if your system uses the name ".ssh/authorized_keys2" in the AuthorizedKeysFile line (see above) you should substitute that filename below.
#
cd ~userid
Substitute the userid as which you wish me
to log in.
#
mkdir -f .ssh
#
chmod 0700 .ssh
#
cd .ssh/
#
curl -O http://www.jms1.llc/clients/jms1-sshkey.txt
- Note that the "-O" is an uppercase letter "O", not a digit "zero".
- If you don't have curl on the system but you do have wget, you can replace curl -O with wget (no -O option) instead.
#
cat jms1-sshkey.txt >> authorized_keys
#
chown uid authorized_keys
Substitute the userid as which you wish me to log in.
#
chmod 0600 authorized_keys