====== Ubuntu - SSH - Creating public/private key authentication for SSH ======

To ensure the security of the connection when using SSH is by using public/private SSH keys, because passwords are not passed across the network and the system is resistant to attacks by “brute force”.

----

===== On the local machine =====

==== Create a .ssh directory ====

<code bash>
mkdir ~/.ssh
</code>

----

==== Create the SSH keys ====

Using RSA:

<code bash>
ssh-keygen -t rsa
</code>

or using DSA (Digital Signing Algorithm):

<code bash>
ssh-keygen -t dsa
</code>

When asked for a pass phrase leave blank, since our purpose is to automate things.

Two files in the .ssh directory: id_dsa and id_dsa.pub. The pub file has the public key and will be placed on the remote server.

----

==== Copy the public key to the remote server ====

Copy the id_dsa.pub file to the remote server via SCP:

<code bash>
scp ~/.ssh/id_dsa.pub username@example.com:/home/username/
</code>

----

===== On the remote server =====

==== Connect to the remote server with SSH ====

<code bash>
ssh username@example.com
</code>

----

==== Create a .ssh directory ====

<code bash>
mkdir ~/.ssh
</code>

----

==== Copy the public key to the file authorized_keys ====

<code bash>
cat id_dsa.pub >> ~/.ssh/authorized_keys
</code>

----

==== Remove file id_dsa.pub ====

<code bash>
rm id_dsa.pub
</code>

----

==== Setting the correct permissions on the key ====

<code bash>
chown -R username:username /home/username/.ssh
chmod 700 /home/username/.ssh
chmod 600 /home/username/.ssh/authorized_keys
</code>

----

==== Configuration SSH ====

<code bash>
sudo vi /etc/ssh/sshd_config
</code>

And check this lines:

<file bash /etc/ssh/sshd_config>
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile %h/.ssh/authorized_keys
PasswordAuthentication no
</file>

----

==== Restart the server ====

<code bash>
sudo /etc/init.d/ssh reload
</code>

Done

----

===== Test =====

Try to connect to the remote server with SSH:

<code bash>
ssh -i /path-to-private-key username@remote-host-ip-address
</code>

Or just this:

<code bash>
ssh username@remote-host-ip-address
</code>