Post

Guide to SSH Keys

Posted
By Bruce Renner
7 min read

Image

Introduction

Secure Shell (SSH) is a cryptographic network protocol that enables secure communication between computers. One of the most effective ways to authenticate SSH connections is through the use of SSH keys. Unlike traditional password-based authentication, SSH keys provide a higher level of security and convenience. This guide delves into what SSH keys are, their benefits, how they work, and detailed instructions on using them across major operating systems. Additionally, we’ll explore best practices for creating strong SSH keys to ensure maximum security.

What Are SSH Keys?

SSH keys are a pair of cryptographic keys used for authenticating SSH connections. They consist of a private key, which should be kept secure on the client machine, and a public key, which is placed on the server you wish to access. When an SSH connection is initiated, the server uses the public key to verify the corresponding private key, allowing secure, password-less authentication.

Benefits of Using SSH Keys

  • Enhanced Security: SSH keys are resistant to brute-force attacks and are more secure than passwords.
  • Convenience: Once set up, SSH keys allow for password-less logins, streamlining the authentication process.
  • Automation: SSH keys facilitate automated processes, such as scripts and deployment pipelines, without the need for manual password entry.
  • Granular Access Control: Public keys can be easily managed and revoked, providing better control over who has access to your systems.

How SSH Keys Work

SSH keys use asymmetric cryptography, involving a pair of keys: a private key and a public key. The private key remains on the client machine and should never be shared, while the public key is placed on the server you wish to access.

  1. Key Generation: A user generates a key pair on their local machine.
  2. Public Key Placement: The public key is copied to the server’s ~/.ssh/authorized_keys file.
  3. Authentication: When connecting, the SSH client uses the private key to respond to a challenge from the server, proving ownership of the corresponding public key.

Creating SSH Keys

Generating strong SSH keys is crucial for maintaining security. Follow these steps to create robust SSH keys.

Generating SSH Keys

The ssh-keygen utility is commonly used to generate SSH key pairs. Here’s how to generate a key pair with recommended settings:

1

ssh-keygen -t ed25519 -C "[email protected]"

Parameters:

  • -t ed25519: Specifies the key type. Ed25519 is recommended for its security and performance.
  • -C "[email protected]": Adds a comment to the key, typically your email address.

After running the command, you’ll be prompted to choose a location to save the key and to enter a passphrase. It’s highly recommended to use a strong passphrase to add an extra layer of security.

Key Types and Strengths

Choosing the right key type is essential for security:

  • RSA: Widely supported and configurable. For RSA keys, use a minimum of 3072 bits, though 4096 bits is recommended for enhanced security.
  • Ed25519: Offers better security with smaller key sizes and faster performance. Preferred for most modern applications.
  • ECSDA: Another elliptic curve option, but less commonly used than Ed25519.

Best Practices for Strong SSH Keys

  • Use Strong Algorithms: Prefer Ed25519 or RSA with at least 3072 bits.
  • Secure Passphrases: Always use a strong, unique passphrase for your private key.
  • Protect Your Private Key: Ensure your private key has appropriate permissions (e.g., chmod 600 ~/.ssh/id_ed25519).
  • Regularly Rotate Keys: Periodically generate new key pairs and update them on your servers.
  • Use ssh-agent: Manage your keys securely in memory, reducing the need to enter passphrases repeatedly.

Using SSH Keys on Major Operating Systems

SSH is available on various operating systems, each with its own methods for managing SSH keys. Below are detailed instructions for Linux, macOS, and Windows.

Linux

Most Linux distributions come with OpenSSH pre-installed. Here’s how to use SSH keys on Linux:

  1. Generate a Key Pair:
1

ssh-keygen -t ed25519 -C "[email protected]"
  1. Start the SSH Agent:
1

eval "$(ssh-agent -s)"
  1. Add Your Private Key to the SSH Agent:
1

ssh-add ~/.ssh/id_ed25519
  1. Copy Your Public Key to the Server:
1

ssh-copy-id user@server_address
  1. Connect to the Server:
1

ssh user@server_address

macOS

macOS also includes OpenSSH by default. The steps are similar to Linux:

  1. Open Terminal.
  2. Generate a Key Pair:
1

ssh-keygen -t ed25519 -C "[email protected]"
  1. Start the SSH Agent:
1

eval "$(ssh-agent -s)"
  1. Add Your Private Key to the SSH Agent:
1

ssh-add -K ~/.ssh/id_ed25519

The -K option stores the passphrase in the macOS keychain.

  1. Copy Your Public Key to the Server:
1

ssh-copy-id user@server_address
  1. Connect to the Server:
1

ssh user@server_address

Windows

On Windows, you have multiple options for using SSH keys, including the built-in OpenSSH client and third-party tools like PuTTY.

Using OpenSSH (Windows 10 and Later)

  1. Install OpenSSH Client: Open PowerShell as an administrator and run:
1

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Client*' | Add-WindowsCapability -Online
  1. Generate a Key Pair:
1

ssh-keygen -t ed25519 -C "[email protected]"
  1. Start the SSH Agent:
1

Start-Service ssh-agent
  1. Set SSH Agent to Start Automatically:
1

Set-Service -Name ssh-agent -StartupType Automatic
  1. Add Your Private Key to the SSH Agent:
1

ssh-add ~\.ssh\id_ed25519
  1. Copy Your Public Key to the Server:
1

ssh-copy-id user@server_address

If ssh-copy-id is not available, manually append the contents of ~/.ssh/id_ed25519.pub to the ~/.ssh/authorized_keys file on the server.

  1. Connect to the Server:
1

ssh user@server_address

Using PuTTY

PuTTY is a popular SSH client for Windows that requires a separate key format.

  1. Download and Install PuTTY: Download PuTTY and PuTTYgen from the official website: https://www.putty.org/
  2. Generate a Key Pair with PuTTYgen:
    1. Open PuTTYgen.
    2. Select Ed25519 as the key type.
    3. Click Generate and move the mouse to create randomness.
    4. Enter a passphrase for added security.
    5. Save the private key (e.g., id_ed25519.ppk) and the public key.
  3. Copy the Public Key to the Server: Manually append the public key to the ~/.ssh/authorized_keys file on the server.
  4. Configure PuTTY to Use the Private Key:
    1. Open PuTTY.
    2. Navigate to Connection > SSH > Auth.
    3. Browse and select your .ppk private key file.
    4. Go back to Session, enter your server details, and connect.

Managing SSH Keys

Effective management of SSH keys is essential for maintaining security and accessibility.

Adding SSH Keys to ssh-agent

The ssh-agent is a background program that holds private keys used for public key authentication. Adding your keys to ssh-agent allows you to enter your passphrase once per session.

1

ssh-add ~/.ssh/id_ed25519

Copying Public Keys to Servers

To allow SSH key-based authentication, your public key must be added to the server’s authorized_keys file.

1

ssh-copy-id user@server_address

Manual Method: If ssh-copy-id is unavailable, you can manually append the public key:

1

cat ~/.ssh/id_ed25519.pub | ssh user@server_address 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys'

Removing and Revoking SSH Keys

Regularly review and remove unused or compromised keys to maintain security.

  1. List Authorized Keys on Server:
1

cat ~/.ssh/authorized_keys
  1. Remove Unwanted Keys: Edit the authorized_keys file and delete the lines corresponding to the keys you wish to revoke.

Security Considerations

While SSH keys provide enhanced security over passwords, it’s crucial to follow best practices to maintain their integrity.

  • Protect Your Private Key: Never share your private key. Store it securely with appropriate file permissions.
  • Use Passphrases: Adding a passphrase to your private key encrypts it, providing an extra layer of security.
  • Regularly Rotate Keys: Periodically generate new key pairs and update them on your servers to minimize the risk of key compromise.
  • Limit Key Usage: Assign specific keys for different servers or services to contain potential breaches.
  • Monitor Authorized Keys: Regularly audit the authorized_keys files on your servers to ensure only trusted keys are present.

Conclusion

SSH keys are a fundamental component of secure system administration and development workflows. By understanding how to generate, manage, and implement SSH keys across various operating systems, you can significantly enhance the security and efficiency of your remote connections. Always adhere to best practices, such as using strong key types, protecting your private keys, and regularly rotating your keys, to maintain a robust security posture.

Security, SSH
SSH Keys Authentication Key Management Secure Access
This post is licensed under CC BY 4.0 by the author.