Authentication#
Now we must talk about the two primary ways to authenticate to a remote Linux system over SSH. SSH itself isn't doing the authentication, the operating system is. SSH is just the connection mechanism to the operating system.
Firstly, we have password-based authentication. If you login to a remote system and you don't have an SSH key installed on it (see below), then you might get the opportunity to type in the user's password. A lot of systems disable password-based authentication these days, however. That's considered best practice, although that's somewhat debatable1.
The most common way of authenticating is via an SSH key pair. We've talked about this concept before: public-key cryptography.
We'll explore both options now.
Password authentication#
On Ubuntu Server 20.04, the openssh-server package (the one you may have had to install above) allows password based authentication by default. This is good for us, because we're just learning, and it allows us to login using a password first and then manage SSH keys for the next section.
Note
If you've using the VirtualBox Virtual Machine we set up earlier in the course, then you'll need to setup port forwarding for SSH on your VM before it can be accessed. We did this in the VM set up section. If you skipped this, then you'll need to go back and set it up otherwise you won't be able to follow along.
Inside of your terminal emulator, connect to your server: ssh ubuntu@<IP>
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 | |
This is a Ubuntu Server 20.04 server I created in AWS for testing and developing this course.
Reviewing the command I ran, we can see:
1 2 | |
The IP 33.26.237.203 was the public IP address of the remote server at the time. I was then prompted to provide my password, which I did, and I was granted access to the system and presented with a shell prompt.
You will need to use the local loopback address on your system because you're forwarding 127.0.0.1 port 2222 to the VM's internal network, on port 22.
Note
We set this up many chapters ago, but if you're struggling then review the chapter again or join the Discord community and let us know what you're having trouble with and we'll try to help.
So your SSH command will be simple: ssh ubuntu@127.0.0.1 -p 2222.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | |
Above, we can see I've used the ssh command inside of a PowerShell prompt made available via Windows Terminal. I then provided my password (badpassword for this demonstration) and I was given access to a shell prompt.
And that's that. We've connected to port TCP/22 on the remote system, established an SSH connection, authenticated using our user's password, and then got access to the system.
Let's explore a method of authentication that's considered better practice and much more aligned with what you're going to be doing out in the real-world.
SSH Keys#
Imagine a really, really long password. That's sort of what SSH keys are like. Here's an example SSH keypair (this is the private key) I generated locally and then deleted:
1 2 3 4 5 6 7 | |
I've chopped this down a bit in the interest of keeping things simple. There is a public key too:
1 | |
The public part of the keypair is much, much shorter. It's also public, so you can feel safe exposing this information if you need to. The private keep should**never** be shared, however. If it's compromised, it has to be replaced on all systems it's installed on.
Let's generate a keypair for ourselves: ssh-keygen
1 2 3 | |
So the command is asking me where I want to save the file to, and it's defaulting to C:\Users\Michael Crilly/.ssh/id_rsa. The keyname id_rsa is the default name. I'm going to provide the command with a new path, for demonstration purposes:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | |
I was also prompted to provide a password too. I highly recommend you password protect your SSH keys. In the even the private key is compromised or accidentally copied/shared, it will give you (probably a lot) of time to discard the keypair, generate a new one, and install it on the servers you have access to, after, of course, deleting the now compromised keypair.
I gave the prompt my terrible (but OK for demonstration purposes) password of badpassword. In return for my effort, I got the following back:
1 2 3 4 | |
So I have two new files: newkey and newkey.pub. We've already seen what these look like, so I won't share them.
The "art" you can see at the bottom of the output, above, is just a bit of fun and doesn't need to be saved, scanned or given much attention.
Installing the key#
We now have a "remote" Ubuntu Server VM we can access via SSH. We have a username and password we can access the server with. Now we have a new SSH keypair. How do we use it to authenticate with the remote server? We install it into our user's account.
Normally we could use the ssh-copy command, but it's not available on Windows 10/11 by default. In light of this, I want to show you how-to do this manually so that you become familiar with a few key files.
First, SSH into your Ubuntu VM using your password: ssh ubuntu@127.0.0.1 -p 2222.
Second, in another PowerShell window/prompt, get your local SSH public key:
1 2 | |
Note
Depending on where you installed your SSH key, you will need to change ~/newkey.pub to your key's public key location. If you never changed the default, then your key will very likely be ~/.ssh/id_rsa.pub.
Third, I want you to copy everything below, but you'll need to replace the public key with your own, from the above work you did. I recommend copying the below into notepad, or some other very basic editor (don't use WordPad or Microsoft Word!), and then editing it, and copying the changes.
1 2 3 4 | |
For the fourth step, using the SSH session on your Ubuntu VM, paste the results from your editor after changing the key to your own. I have these results:
And when I press Enter I get the following:
1 2 3 4 | |
And if I look inside the ~/.ssh/authorized_keys I get:
1 2 3 | |
Now log out of your SSH session by simply typing exit and then repeat your ssh command from earlier. You will be automatically logged into your system without having to type in the password of your user. You should be asked for your SSH key's password, however. You can use ssh-add on your Windows host to add the key to SSH Agent, allowing you to login and out freely, without the password.
If you've had any issues with the above, reach out to us on the Discord community.