SSH

Configure secure SSH access with key-based authentication, server hardening and convenient client aliases.

---

1. SSH key management (client)

   Generate unique keys for each device to improve security and auditability.

   1. Generate named key

      Instead of the default name, label the key after the hostname (e.g., id_hp-laptop or id_macbook-pro).

      ssh-keygen -t ed25519 -f ~/.ssh/id_{{HOSTNAME_VAR}}

   2. Copy key to server

      Use ssh-copy-id to automatically handle directory creation and permissions on the remote server.

      ssh-copy-id -i ~/.ssh/id_{{HOSTNAME_VAR}} {{USERNAME_VAR}}@{{SERVER_IP_VAR}}

2. Server security (host)

   Once your key is verified, disable password logins to prevent brute-force attacks.

   1. Install SSH server

      Ensure the OpenSSH server is installed and active.

      sudo apt install openssh-server -y && sudo systemctl enable --now ssh

   2. Configure SSH daemon

      Edit the server configuration to enforce key-based authentication.

      sudo nano /etc/ssh/sshd_config

      /etc/ssh/sshd_config

      # Disable password auth
      PasswordAuthentication no
      
      # Allow using SSH public/private keys
      PubkeyAuthentication yes
      
      # Prevent root login entirely
      PermitRootLogin no
      
      # Custom SSH port (optional)
      Port 2222
      
      # Only allow specific users (optional)
      AllowUsers {{USERNAME_VAR}} $USERNAME2 $USERNAME3

   3. Verify and restart

      Always check the status before exiting to ensure you aren’t locked out.

      sudo systemctl restart ssh && systemctl status ssh

3. SSH client (local)

   Simplify your workflow by creating aliases. This allows you to type ssh $ALIAS_NAME instead of remembering IPs and key paths.

   1. Edit config

      Open (or create) the SSH config file on your local machine.

      nano ~/.ssh/config

   2. Add host alias

      Define your server details. Now you can connect using just the alias name.

      ~/.ssh/config

      # Default settings for all hosts
      Host *
          ServerAliveInterval 60
          ServerAliveCountMax 5
      
      # Example host
      Host {{HOSTNAME_VAR}}
          HostName {{SERVER_IP_VAR}}
          User {{USERNAME_VAR}}
          Port 22
          IdentityFile ~/.ssh/id_{{HOSTNAME_VAR}}

   3. Connect via alias

      Test the new configuration.

      ssh {{HOSTNAME_VAR}}

4. SSH authorized_keys (optional)

   Use a system-wide authorized keys directory to manage SSH keys for multiple users from a single location.

   1. SSH serivce

      Ensure SSH is enabled as a system service.

      sudo systemctl enable ssh --now

   2. Global keys directory

      Create a global keys directory.

      sudo mkdir -p /etc/ssh/authorized_keys

   3. Copy authorized keys

      Copy your authorized keys file and set strict permissions.

      sudo cp ~/.ssh/authorized_keys /etc/ssh/authorized_keys/$USER

      sudo chown root:root /etc/ssh/authorized_keys/$USER

      sudo chmod 644 /etc/ssh/authorized_keys/$USER

   4. Add AuthorizedKeysFile

      Open (or create) the global SSH config file on your local machine.

      sudo nano /etc/ssh/sshd_config

      Add or update this line in config.

      /etc/ssh/sshd_config

      AuthorizedKeysFile /etc/ssh/authorized_keys/%u .ssh/authorized_keys

   5. Restart SSH

      Test configuration and restart the SSH service.

      sudo sshd -t && sudo systemctl restart ssh