Securing Remote Access with SSH Key-Based Authentication

The Problem: Password Vulnerability in Remote Access

Password-based SSH authentication is susceptible to brute-force attacks, where automated scripts attempt thousands of common password combinations to gain entry. For automated server management or high-security environments, relying on passwords creates a significant security gap and prevents seamless automation.

The solution is SSH Key-Based Authentication. This method uses asymmetric cryptography—a public key and a private key—to verify identity. The server holds the public key, and the client holds the private key. Because the private key never leaves your local machine, there is no password to intercept or guess.

Prerequisites

• A local machine (Client) with an SSH client installed (OpenSSH is standard on Linux, macOS, and Windows 10/11).
• A remote server (Host) with an SSH daemon (sshd) running.
• Existing password-based SSH access to the remote server to perform the initial setup.
• User privileges on both machines to modify home directory permissions.

Step 1: Generate the Key Pair

Run the following command on your local client machine. While RSA is common, ed25519 is currently recommended for better security and performance.

ssh-keygen -t ed25519 -C "user@workstation"

Execution Details:

• -t ed25519: Specifies the algorithm.
• -C: Adds a comment to identify the key in the server's authorized list.

When prompted for a file location, press Enter to accept the default (usually ~/.ssh/id_ed25519). When prompted for a passphrase, enter one for an additional layer of security; this encrypts the private key on your disk.

Step 2: Transfer the Public Key to the Server

You must place your public key (the .pub file) into the ~/.ssh/authorized_keys file on the remote server. The ssh-copy-id utility is the most reliable way to handle this, as it automatically sets the correct permissions.

Run this from your local client machine:

ssh-copy-id -i ~/.ssh/id_ed25519.pub username@remote-server-ip

Risk: Ensure you are copying the .pub file. Never transfer your private key (the file without the .pub extension) to a remote server.

Step 3: Verify Key-Based Access

Before disabling passwords, confirm the key is working. Attempt to log in from your local machine:

ssh username@remote-server-ip

If you set a passphrase, you will be asked for the passphrase, but not the remote user's account password. To verify the authentication method being used, run the command with verbose output:

ssh -v username@remote-server-ip

Look for a line in the output stating Authentication succeeded (publickey). If the server still asks for a password, check the remote server's directory permissions:

• ~/.ssh directory: Must be 700 (drwx------).
• ~/.ssh/authorized_keys file: Must be 600 (-rw-------).

Step 4: Disable Password Authentication

Once key access is confirmed, disable password logins to block brute-force attempts. This requires root or sudo permissions on the remote server.

1. Open the SSH configuration file: sudo nano /etc/ssh/sshd_config
2. Locate the PasswordAuthentication directive and change it to: PasswordAuthentication no
3. Ensure PubkeyAuthentication yes is also set.
4. Save the file and restart the SSH service: sudo systemctl restart ssh (or sshd).

Comparison: RSA vs. Ed25519

Feature	RSA (3072+ bits)	Ed25519
Security	Strong (if key size is large)	Very Strong (modern elliptic curve)
Performance	Slower key generation/signing	Faster and more efficient
Key Size	Large strings	Very short strings
Compatibility	Universal	OpenSSH 6.5+

Recovery and Rollback

Warning: If you disable password authentication and lose your private key, you will be locked out of the server.

Rollback Procedure: If you lose access, you must use an out-of-band management tool (such as a VPS provider's web console, IPMI, or physical monitor/keyboard) to log in locally. Once inside, edit /etc/ssh/sshd_config, set PasswordAuthentication yes, and restart the SSH service to regain remote access.