RockyLinux8.8 ; SSH connection using public key cryptography

Contents

SSH connection with authentication using public key cryptography

SSH connection with authentication using public key cryptography

Create a key pair

Create a public/private key pair for a user connecting to a Linux server using OpenSSH.
Use ssh-keygen to create the key pair.
The creation of a public/private key pair must be done as a user with remote login privileges.

If you do not specify the destination and file name, id_ed25519 and id_ed25519.pub will be created in /home/(user name)/.ssh/. On the way, enter the password for the key.

# su - huong
[huong@Lepard~]$ ssh-keygen -t ed25519
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/huong/.ssh/id_ed25519):
Created directory '/home/huong/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/huong/.ssh/id_ed25519.
Your public key has been saved in /home/huong/.ssh/id_ed25519.pub.
The key fingerprint is:
SHA256:GbVD5aLnj4lgr1pn84kN/0P4PxwWMnXmom9ggcsiUq0 huong@Lepard
The key's randomart image is:
+--[ED25519 256]--+
|          o..    |
|         o o  . o|
|       .. +... + |
|      . .+.o+ o .|
|     . .S..o = o |
|    . E .o+ = o  |
|     .+.=..+ = . |
|     o = O =o =  |
|    ....+ B.o+.. |
+----[SHA256]-----+

# su - huong

[huong@Lepard~]$ ssh-keygen -t ed25519

Generating public/private ed25519 key pair.

Enter file in which to save the key (/home/huong/.ssh/id_ed25519):

Created directory '/home/huong/.ssh'.

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /home/huong/.ssh/id_ed25519.

Your public key has been saved in /home/huong/.ssh/id_ed25519.pub.

The key fingerprint is:

SHA256:GbVD5aLnj4lgr1pn84kN/0P4PxwWMnXmom9ggcsiUq0 huong@Lepard

The key's randomart image is:

+--[ED25519 256]--+

| o.. |

| o o . o|

| .. +... + |

| . .+.o+ o .|

| . .S..o = o |

| . E .o+ = o |

| .+.=..+ = . |

| o = O =o = |

| ....+ B.o+.. |

+----[SHA256]-----+

$ cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys
$ chmod 700 ~/.ssh/

$ cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys

$ chmod 600 ~/.ssh/authorized_keys

$ chmod 700 ~/.ssh/

Copy the private key to the client PC (using WinSCP) Configure WinSCP settings
①Start WinSCP, set the following in "New Site", and click "Save".
Host name :　Server IP address
Port number :　 SSH port number
User name :　User name
Password : 　User password

Site name : Name the connection with any name.
Click "OK"

Click "Login" to return to the following screen.

If the following screen appears, click "Update".

In the following screen, enter the user's password in the "Pasword" field.

The following screen will appear. Copy id_ed25519 in the /home/user/.ssh directory to any location on the windows side (select id_ed25519 and drag & copy it to the left side).

Change to log in only with private key

Edit the SSH configuration file to disable password authentication.
su - to become root.

$ su -
Password:
# vi /etc/ssh/sshd_config
# Per Line 71 : Add "PasswordAuthentication no" under "#PasswordAuthentication yes"
PasswordAuthentication no

# systemctl restart sshd

$ su -

Password:

# vi /etc/ssh/sshd_config

# Per Line 71 : Add "PasswordAuthentication no" under "#PasswordAuthentication yes"

PasswordAuthentication no

# systemctl restart sshd

How to connect with Tera Term

Start Tera Term, and select "File" menu "New connection

Host : Server IP Address
TCP port : SSH Port number

If you get the following security warning "Replace.... "check the box and "Continue".

User name : Login username
Password :Password specified in the creation of a public/private key pair
Check the "Use RSA/DSA...." checkbox. and in the "Private key file" field, specify the "id_ed25519" that you just saved in windows.

Creating a private key using PuTTYgen

Start Winscp and launch "Run Puttygen" from "Tools".
Select the appropriate server

Click Load

The [ Open File Dialog ] will open, change the file type to [ All Files (*. *)] and load the private key id_ed25519 transferred from the Linux server.