Difference between revisions of "SSH"

From Autopilot Wiki
Jump to: navigation, search
(Created page with "== Enabling == * Use <code>sudo raspi-config</code> ** Interfaces ** SSH == Configuring == By default, configuration is stored in <code>/etc/ssh/sshd_config</code> === Use...")
 
Line 13: Line 13:
 
It's usually bad to be able to login with a password to a network facing computer, especially if your password is two letters like ours tend to be, so we typically want to disable password access over SSH and instead use RSA keys.
 
It's usually bad to be able to login with a password to a network facing computer, especially if your password is two letters like ours tend to be, so we typically want to disable password access over SSH and instead use RSA keys.
  
* '''Enable password login via ssh'''
+
* '''On Target Machine - Enable password login via ssh'''
 
** Edit /etc/ssh/sshd_config, make sure the following values are set
 
** Edit /etc/ssh/sshd_config, make sure the following values are set
 
*:<syntaxhighlight>ChallengeResponseAuthentication yes
 
*:<syntaxhighlight>ChallengeResponseAuthentication yes
Line 20: Line 20:
 
** Restart the ssh service
 
** Restart the ssh service
 
*: <syntaxhighlight>sudo systemctl restart ssh</syntaxhighlight>
 
*: <syntaxhighlight>sudo systemctl restart ssh</syntaxhighlight>
* '''Generate an RSA key'''
+
* '''On Source Machine - Generate an RSA key'''
 
** check if you have an rsa key generated, they usually live in ~/.ssh
 
** check if you have an rsa key generated, they usually live in ~/.ssh
 
*: <syntaxhighlight>ls -al ~/.ssh</syntaxhighlight>
 
*: <syntaxhighlight>ls -al ~/.ssh</syntaxhighlight>
Line 26: Line 26:
 
*: <syntaxhighlight>ssh-keygen -t rsa</syntaxhighlight>
 
*: <syntaxhighlight>ssh-keygen -t rsa</syntaxhighlight>
 
*: you'll be prompted where to save the key (if you don't have one just leave it in the default location) and whether to use a passphrase. Having a passphrase means you need to type a password every time you want to use your rsa key. up 2 u. without a passphrase the security model is you assume that no one will be able to access your private key file
 
*: you'll be prompted where to save the key (if you don't have one just leave it in the default location) and whether to use a passphrase. Having a passphrase means you need to type a password every time you want to use your rsa key. up 2 u. without a passphrase the security model is you assume that no one will be able to access your private key file
* '''Install the rsa key'''
+
* '''On Source Machine - Install the rsa key'''
 
** Use ssh-copy-id
 
** Use ssh-copy-id
 
*: <syntaxhighlight>ssh-copy-id <user>@<ip or url></syntaxhighlight>
 
*: <syntaxhighlight>ssh-copy-id <user>@<ip or url></syntaxhighlight>
Line 35: Line 35:
 
**: then to install ssh-copy id it's
 
**: then to install ssh-copy id it's
 
**: <syntaxhighlight>brew install ssh-copy-id</syntaxhighlight>
 
**: <syntaxhighlight>brew install ssh-copy-id</syntaxhighlight>
* '''Disable password login via ssh'''
+
* '''On Target Machine - Disable password login via ssh'''
 
** Edit /etc/ssh/sshd_config, make sure the following values are set
 
** Edit /etc/ssh/sshd_config, make sure the following values are set
 
*:<syntaxhighlight>ChallengeResponseAuthentication no
 
*:<syntaxhighlight>ChallengeResponseAuthentication no

Revision as of 00:23, 15 December 2021

Enabling

  • Use sudo raspi-config
    • Interfaces
    • SSH

Configuring

By default, configuration is stored in /etc/ssh/sshd_config

Use RSA Key

It's usually bad to be able to login with a password to a network facing computer, especially if your password is two letters like ours tend to be, so we typically want to disable password access over SSH and instead use RSA keys.

  • On Target Machine - Enable password login via ssh
    • Edit /etc/ssh/sshd_config, make sure the following values are set
    ChallengeResponseAuthentication yes
    PasswordAuthentication yes
    UsePAM yes
    • Restart the ssh service
    sudo systemctl restart ssh
  • On Source Machine - Generate an RSA key
    • check if you have an rsa key generated, they usually live in ~/.ssh
    ls -al ~/.ssh
    • if you don't have an rsa key generated, generate a key:
    ssh-keygen -t rsa
    you'll be prompted where to save the key (if you don't have one just leave it in the default location) and whether to use a passphrase. Having a passphrase means you need to type a password every time you want to use your rsa key. up 2 u. without a passphrase the security model is you assume that no one will be able to access your private key file
  • On Source Machine - Install the rsa key
    • Use ssh-copy-id
    ssh-copy-id <user>@<ip or url>
    • If you don't have ssh-copy id...
      • On a Mac:
      Install with homebrew. if you don't have homebrew the install command is
      /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
      then to install ssh-copy id it's
      brew install ssh-copy-id
  • On Target Machine - Disable password login via ssh
    • Edit /etc/ssh/sshd_config, make sure the following values are set
    ChallengeResponseAuthentication no
    PasswordAuthentication no
    UsePAM yes
    • Restart the ssh service
    sudo systemctl restart ssh