Accessing a VPS securely via SSH from Windows

As part of the process of securing your VPS (see the article ‘How to secure a VPS running Ubuntu Linux’), SSH access via username and password can be a critical weak point. People tend to use passwords that are easy to remember (even when they contain special characters, e.g. Ci@oM0nd0): this can expose you to access attempts by malicious users — using the brute-force technique, your password can indeed be found.

This attack technique essentially consists of trying to access the server using a database of known passwords until the correct one is found. If you have followed the guide mentioned at the start of this article, you have already set up an unprivileged user who can use sudo and installed Fail2ban to keep unwanted login attempts at bay. With the next steps we will strengthen the security of your VPS even further.

Prerequisites

1. A VPS running a Linux operating system
2. A user with adequate privileges, i.e. sudo (in this example it is called utente_vps)
3. Your own computer must be running Microsoft Windows

In this guide we will see how to create the SSH key pair using PuTTY.

Step 1 — Install PuTTY

1. From the official PuTTY developer’s page, download the installer for Windows
2. Once the package has been downloaded, double-click it to start the installation; by default PuTTY will be installed in the directory C:\Program Files\PuTTY\
3. Once the installation process has finished, click Finish to close the wizard

Step 2 — Creating the keys with PuTTYgen

1. Launch PuTTYgen using whichever method you prefer; in this example we will use the Windows search bar, so type PuTTYgen
2. Right-click PuTTYgen and select ‘Run as administrator’
3. In the PuTTY Key Generator window, click the ‘Generate’ button and move the mouse pointer around inside the window until the green bar reaches the end. The mouse movement generates the random numbers PuTTYgen uses to create the certificate.
4. Save the public and private keys (‘Save public key’ and ‘Save private key’ buttons) in the location of your choice, taking care to leave the private key without a passphrase (for now). At this point you will have your certificates, e.g. mypub_key.pub and mypriv_key.ppk. Be careful not to change the file extensions: the public certificate has the .pub extension, the private one .ppk. Leave PuTTYgen open for now.

Step 3 — Copy the public key to the VPS

Now that we have our key pair, it is time to copy the public key to your VPS. Launch putty.exe (or use ssh directly from the command prompt) and connect to your VPS via its IPv4 address, using the user with sudo privileges (in our example it is called utente_vps).

From the PuTTY Key Generator window, select and copy the entire contents of the ‘Public key for pasting into OpenSSH authorized_keys file:’ field (make sure you have selected everything: the field has a scroll bar).

Go back to the SSH session you opened earlier and, from utente_vps’s home directory, move into the .ssh folder:

utente_vps@mio_vps:~$ cd .ssh/

If the folder happens not to exist, don’t worry — simply create it with:

utente_vps@mio_vps:~$ mkdir .ssh
utente_vps@mio_vps:~$ cd .ssh/

At this point, using the nano text editor, you can create or edit the authorized_keys file inside the .ssh folder: paste the text you copied earlier (the public key) without adding anything else (no spaces or line breaks). To save the file, use the CTRL+X key combination and, if asked whether you want to overwrite the file, confirm with Y.

Step 4 — Connect via SSH using the private key

Now go back to PuTTY, taking care to re-enter your VPS’s IP address and, where applicable, the SSH port (to change the standard port 22, read the article ‘How to secure a VPS running Ubuntu Linux’), and in the left-hand column look for the ‘Connection > SSH > Credentials’ option.

In the right-hand section, under ‘Private key file for authentication’, click the ‘Browse’ button and select your private key (.ppk extension) generated earlier. Go back to ‘Session’; if you prefer, you can enter a name in the ‘Saved Sessions’ field and click the ‘Save’ button so you don’t have to repeat the procedure every time. All that’s left now is to click ‘Open’.

Once you have entered your username and pressed ENTER, your VPS console will appear without you having to enter a password — securely.

The next step, to close the loop, is to disable password access altogether.

Guide originally published on the blog of VPS GREEN, the VPS service on our green private cloud.

• VPS
• SSH
• PuTTY
• Windows
• SSH keys
• security