Enable SSH public key authentication

This article describes the procedure to set up a Secure Shell (SSH) public key authentication.

Ensure you have the Public part of you SSH key ready - that's the contents of the file id_rsa.pub that you might have generated in https://docs.rackspace.com/docs/connecting-to-a-server-using-ssh-on-linux-or-mac-os.
Log in to the server.
Verify that the user exists:
```
getent passwd <username>
```
Look up the value assigned to the AuthorizedKeysFile parameter within /etc/ssh/sshd_config to determine the file where the key is stored:
```
 grep AuthorizedKeysFile /etc/ssh/sshd_config
```
Note: The default location is ~/.ssh/authorized_keys within the user's default home directory.
Switch to the user's home directory:
```
cd /home/<username>
```
Check permission levels for the .ssh/ directory. It should have 0700 permissions and be owned by the user.
```
 ls -hald .ssh
```
a. If the directory does not exist, create it and set the permissions to 0700:
```
 mkdir -m 700 .ssh
```
b. If the directory exists, but ownership and permissions are incorrect, correct it using:
```
 chmod 700 .ssh/
 chown -R username:username .ssh
```
Switch to .ssh/ directory and edit the authorized_keys file:
```
cd .ssh/
vim authorized_keys
```

Add the SSH Public Key to the end of the authorized_keys file:

ssh-rsa AAAThisIsAnExamplePublicPortionOfAPublicPrivateKeyPairIsMuchShorterThanARealOne/1/2/3/4/5/6/7/8/9/0t05WFE= [email protected]

Check and update the authorized_keys file permission to 600 and ensure proper ownership of the file:
```
ls -hal authorized_keys

chmod 600 authorized_keys
chown -R username:username authorized_keys
```

Disable password authentication

If you want all users to log in with public keys and not passwords, you can disable password authentication.

Important: Disabling password authentication locks out all users who used a password to access the server if SSH authentication is not already configured for their account.

Create a backup of the sshd_config file before making any changes:

mkdir /home/username/backup
cp /etc/ssh/sshd_config /home/username/backup/sshd_config.bak

Edit the sshd_config file:
```
vim /etc/ssh/sshd_config
```
Find the PubkeyAuthentication parameter and set it to yes. If the line is commented, remove any
comment indicators (#).
Find the PasswordAuthentication parameter within the same file and set it to no.
Save the changes to the file and exit the file.
Check the syntax by using sshd -t. If there are no errors, reload sshd:
```
service sshd reload
```

Additional notes:

The private key file on your local workstation (client-side) should have permissions set to
600, and the .ssh directory should have the permissions set to 700. The
authorized_keys files also work with 644 permissions, but 600 is
more secure.

Updated 10 days ago