Creating keys with ssh-keygen

ssh-keygen is a standard component of the Secure Shell (SSH) protocol packages found on Unix and Microsoft Windows computer systems. These protocols are used to establish secure shell sessions between remote computers over insecure networks using various cryptographic techniques. Specifically, the ssh-keygen utility is used to generate, manage, and convert authentication keys for access using these protocols.

# Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

Creating keys:

To generate keys for SSH access, run:

# ssh-keygen

By default, it uses 3072-bit RSA. To generate keys with stronger encryption (for example, 4096-bit RSA), you can run:

# ssh-keygen -t rsa -b 4096

Once you run the command, the utility will first ask for a directory in which to store the keys. You can leave it blank by pressing Enter to use the default path:

Generating public/private rsa key pair.
Enter file in which to save the key (/user/.ssh/id_rsa):

Next, it will offer the option to add a passphrase for using the key (optional): 

Enter passphrase (empty for no passphrase):
Enter same passphrase again:

You can leave it blank if you do not want to enter a passphrase when using the key to connect. Once you have completed these steps, the keys will have been created, and output similar to the following should appear:

Your identification has been saved in /user/.ssh/id_rsa
Your public key has been saved in /user/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:7dRQDxLJcKXoZAVByMHQ0aR5AG2O8qgu7BT83kRgvVc user@equipo
The key's randomart image is:
+---[RSA 3072]----+
|    oB+B*==++    |
|    . B+.+o+ o   |
|   o =o =Eo   .  |
|. o o o=.. o     |
| o + o .S o .    |
|  + o .  o       |
|.o . .    .      |
|+.. o            |
|+o . .           |
+----[SHA256]-----+

Transferring keys:

To use the keys with the remote server, you must copy the key to the destination server. There are several ways to transfer it, but you can run the following command to do so more quickly (replace the username and IP address with those of the remote server):

# ssh-copy-id usuario@direcciónIP

A Windows system does not include this function, but it is easy to replicate. You can run the following (replace the username and IP address with those of the remote server):

# ssh usuario@direcciónIP "umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys || exit 1" < .ssh\id_rsa.pub

You can now test access directly using the generated key without using the server password. As explained earlier, if you set a passphrase when generating the key, you will be prompted to enter it to access the server.

Disabling password authentication (optional)

You can also disable password authentication once you have access using the SSH key. This allows you to prevent brute-force attacks against the server by removing this authentication method.

To do this, edit the service configuration file and modify the PasswordAuthentication parameter by uncommenting it and setting it to "no" to disable it. You can run this sed command directly to replace the default configuration with the setting mentioned above:

# sed -i "/#PasswordAuthentication yes/c\PasswordAuthentication no" /etc/ssh/sshd_config

Finally, reload the SSH service configuration for the change to take effect:

# systemctl reload sshd.service

We hope this tutorial has been helpful. If you have any questions about this or anything else related to your servers on Clouding, feel free to contact soporte@clouding.io We're here to help!