Replacing SSH Password Authentication with Key-Based Access

The Security Risk of Password Authentication

Password-based SSH access is vulnerable to brute-force attacks and credential stuffing. Even with complex passwords, the server must remain open to authentication attempts, increasing the attack surface. The solution is key-based authentication, which uses a public-private key pair to verify identity without transmitting a password over the network.

Prerequisites

• A local machine (client) with an SSH client installed (OpenSSH).
• A remote Linux server with an SSH daemon (sshd) running.
• A user account on the remote server with sudo privileges (required for disabling password logins globally).
• Network connectivity to the server on port 22 (or your custom SSH port).

Step 1: Generate the Key Pair

Run this command on your local machine. Ed25519 is recommended over RSA for better security and performance.

ssh-keygen -t ed25519 -C "user@workstation"

Details:

• -t ed25519: Specifies the Ed25519 algorithm.
• -C: Adds a comment to the public key to help identify it later.

When prompted for a passphrase, enter one to encrypt the private key on your disk. If the local machine is compromised, the attacker cannot use the key without this passphrase.

Step 2: Transfer the Public Key to the Server

Use the ssh-copy-id utility to install your public key into the remote server's authorized_keys file. Run this from your local machine:

ssh-copy-id -i ~/.ssh/id_ed25519.pub remote_user@server_ip

You will be prompted for the remote user's password one last time to complete the transfer. This command automatically handles the creation of the ~/.ssh directory and sets the correct permissions.

Step 3: Verify Key-Based Access

Before disabling passwords, verify that the key works. Run the following from your local machine:

ssh -v remote_user@server_ip

Look for the following line in the verbose output to confirm the key was used:

debug1: Authentication succeeded (publickey).

Step 4: Disable Password Authentication

Once key access is confirmed, disable password logins to lock out brute-force attempts. Run these commands on the remote server as a user with sudo permissions.

1. Back up the configuration file:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

2. Edit the configuration file using a text editor (e.g., nano or vi):

sudo nano /etc/ssh/sshd_config

Locate the following directives and ensure they are set as follows:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes

3. Reload the SSH service to apply changes:

sudo systemctl reload sshd

Permissions and Security Matrix

SSH is strict about file permissions. If permissions are too open, the server will reject the key for security reasons. Ensure your remote server follows this structure:

Path	Required Mode	Owner	Reason
~/.ssh/	700 (drwx------)	User	Prevent other users from listing keys.
~/.ssh/authorized_keys	600 (-rw-------)	User	Prevent modification of allowed keys.
~/.ssh/id_ed25519 (Local)	600 (-rw-------)	User	Protect the private key from local users.

Troubleshooting and Recovery

Symptom: You are prompted for a password even after following these steps.

• SELinux Check: On RHEL/CentOS systems, incorrect security contexts can block access. Check with ls -Z ~/.ssh. If labels are incorrect, run restorecon -Rv ~/.ssh.
• Ownership Check: Ensure the .ssh folder is owned by the user, not root. Run chown -R user:user ~/.ssh.

Rollback: If you are locked out of the server, you must use an out-of-band management tool (like a cloud console, IPMI, or physical monitor/keyboard) to revert the changes:

sudo cp /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
sudo systemctl reload sshd