Moving Beyond Passwords: Implementing SSH Public Key Authentication

The Password Brute-Force Problem

Leaving SSH password authentication enabled on a public-facing server is an invitation for automated botnets. These scripts continuously attempt thousands of common password combinations per minute, filling your logs with failed login attempts and increasing the risk of a successful breach through credential stuffing.

The solution is to shift from knowledge-based authentication (something you know, like a password) to possession-based authentication (something you have, like a private cryptographic key). By using SSH Public Key Authentication, you eliminate the password exchange entirely, making brute-force attacks mathematically infeasible.

How Asymmetric Keys Replace Passwords

Public key authentication relies on a key pair: a public key and a private key. The public key is shared openly and placed on any server you wish to access. The private key stays exclusively on your local machine and must never be shared.

When you attempt to connect, the server uses the public key to encrypt a challenge. Only the holder of the corresponding private key can decrypt this challenge and sign it back to the server. Because the private key never travels across the network, an attacker sniffing the traffic cannot steal your credentials.

Implementing Key-Based Access

To transition to key-based access, you must generate a pair and distribute the public half to the remote host. This process assumes you are using a Unix-like environment (Linux or macOS) and have existing password access to the remote server for the initial setup.

Step 1: Generate the Key Pair

Run this command on your local machine. Use the -t ed25519 flag for a modern, secure, and performant algorithm.

ssh-keygen -t ed25519 -C "your_email@example.com"

When prompted, enter a passphrase. This encrypts the private key on your local disk, ensuring that if your laptop is stolen, the thief cannot use the key without the passphrase.

Step 2: Transfer the Public Key

Use the ssh-copy-id utility to install your public key into the server's ~/.ssh/authorized_keys file. This tool automatically handles the necessary directory creation and permission settings.

ssh-copy-id -i ~/.ssh/id_ed25519.pub username@remote-server-ip

Risk: If you manually copy the key via a text editor, ensure the .ssh directory is set to 700 and authorized_keys is set to 600. SSH will reject keys if the permissions are too open (e.g., world-writable).

Hardening the Server

Simply adding a key does not stop password attacks; you must explicitly tell the SSH daemon (sshd) to stop accepting passwords. This requires root or sudo permissions on the remote server.

Edit the configuration file /etc/ssh/sshd_config and ensure the following directives are set:

PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no

After saving the file, restart the service to apply changes:

sudo systemctl restart ssh

Verification and Trade-offs

To verify the change, open a new terminal window and attempt to connect. You should be prompted for your private key passphrase, not the server user's password. To confirm the server is ignoring passwords, try connecting from a machine that does not have a registered key; the server should immediately return Permission denied (publickey) without asking for a password.

Critical Limitations

• Key Loss: If you lose your private key and have disabled password authentication, you are locked out. Always maintain a secure backup of your keys or ensure a secondary administrative access method (like a cloud console or physical terminal) is available.
• Local Compromise: If you store your private key without a passphrase, any user or process with access to your local ~/.ssh folder can impersonate you on all connected servers.

Summary Checklist

• Generate Ed25519 keys locally.
• Use a passphrase for local encryption.
• Deploy public keys via ssh-copy-id.
• Disable PasswordAuthentication in sshd_config.
• Test connection in a separate session before logging out.