Accessing a VPS securely via SSH from Linux or macOS

As part of the process of securing your VPS (see the article ‘How to secure a VPS running Ubuntu Linux’), SSH access via username and password can be a critical weak point. People tend to use passwords that are easy to remember (even when they contain special characters, e.g. Ci@oM0nd0): this can expose you to access attempts by malicious users — using the brute-force technique, your password can indeed be found.

This attack technique essentially consists of trying to access the server using a database of known passwords until the correct one is found. If you have followed the guide mentioned at the start of this article, you have already set up an unprivileged user who can use sudo and installed Fail2ban to keep unwanted login attempts at bay. With the next steps we will strengthen the security of your VPS even further.

Prerequisites

1. A VPS running a Linux operating system
2. A user with adequate privileges, i.e. sudo (in this example it is called utente_vps)
3. Your own computer must be running macOS or any Linux-based distribution
4. The ssh-keygen application, normally included with Linux and macOS
5. The ssh-copy-id application, normally included with Linux and macOS

In this guide we will see how to create the SSH key pair using ssh-keygen, which is part of OpenSSH.

How SSH key-based access works

Before we start, a brief word about how it works. An SSH key pair consists, as the name suggests, of two cryptographic keys, one public and one private, used to authenticate a client on an SSH server. The private key is kept by the client and must be stored safely and never disclosed: if it is compromised, lost or stolen, it will allow whoever holds it to access the server. The corresponding public key can be shared without any consequence, and is normally uploaded to the server you want to access. The public key is in fact used to encrypt the ‘messages’ that only the private key can decrypt.

In a standard configuration, the public key is placed in the authorized_keys file found in the ~/.ssh/ folder of each enabled user. When a client attempts to connect to the server via SSH, the service checks whether the user holds the private key: if so, access is granted.

Step 1 — Creating the keys with ssh-keygen

1. Open the Terminal application
2. Type the command:

   $ ssh-keygen -t rsa
   Generating public/private rsa key pair.
   Enter file in which to save the key (/Users/tuo_utente_macos/.ssh/id_rsa):

   or, if you are on Linux:

   Enter file in which to save the key (/home/tuo_utente_linux/.ssh/id_rsa):

   It will ask you where to save the key pair: you can keep the path it suggests or choose one you prefer. If a key pair should already exist, this message will appear:

   /Users/tuo_utente_macos/.ssh/id_rsa already exists.
   Overwrite (y/n)?

   In that case it is up to you to decide whether to overwrite it or to stop the procedure and repeat it, changing the path where the new keys are saved.
3. For extra security you can also specify a passphrase, which you will have to enter every time you use the keys. It’s your call: if you press ENTER without typing anything, no password will be needed.

We have now created the key pair, saved in the path given at the start of the procedure (normally the hidden .ssh directory inside your user profile): in the example you can find the keys in /Users/tuo_utente_macos/.ssh/ or /home/tuo_utente_linux/.ssh/. Inside the folder you will find two files, id_rsa and id_rsa.pub: as the name suggests, id_rsa.pub is the public key, which must be uploaded to your VPS, while id_rsa is the private key and must absolutely not be shared.

Step 2 — Copy the key to the VPS

Let’s now copy the public key to the VPS. Here the ssh-copy-id command comes to our aid: from the Terminal application on your macOS or Linux machine, type:

$ ssh-copy-id Nome_Utente@IPv4_del_VPS
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/Users/tuo_utente_macos/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Nome_Utente@IPv4_del_VPS's password:

In any case, you must enter your VPS user’s password to confirm the copy.

Number of key(s) added:        1
Now try logging into the machine, with:   "ssh 'Nome_Utente@IPv4_del_VPS'"
and check to make sure that only the key(s) you wanted were added.

If everything was done correctly, connecting to the VPS via SSH with the unprivileged user will now take you straight to the remote console without being asked for a password — unless you set a passphrase when you created the keys: in that case you will not use your VPS user’s password, but the passphrase you chose to set.

Conclusions

You can now access your VPS with a touch more security. There is one further measure you can put in place: now that the keys are working, you can disable password access altogether for the SSH service.

Guide originally published on the blog of VPS GREEN, the VPS service on our green private cloud.

• VPS
• SSH
• ssh-keygen
• Linux
• macOS
• SSH keys
• security