Adding an SSH Key to a Server

SSH – a network protocol that enables remote management of an operating system via the command line; however, unlike Telnet, it encrypts all traffic, including passwords, which is not the most secure method of server authentication

SSH keys – a pair of cryptographic files (public and private) that replace passwords when connecting to remote servers

• The private key is stored only on the client PC and is never disclosed
  
• The public key (.pub) is sent to the server, where it is stored in the corresponding file. By default, this is home/[USER]/.ssh/authorized_keys
  with permissions
  600 (-rw------) -rw------- 1 194 Jun 21 08:27
  

Connect to a Linux server

Connecting to the server

First configuration example for Unix-based systems

First, you need to verify that the SSH server on the server side and the SSH client on the client PC from which the connection will be made are present on the system

Check for the presence of the SSH server using one of the following commands: systemctl status ssh systemctl status sshd service ssh status


Check for the presence of the SSH server using the command
ssh -V

Enabling SSH connections using a key

First, you need to enable authorization in the configuration file, which is located by default at /etc/ssh/sshd_config To do this, on the server you’ll be connecting to, open this file and uncomment the PubkeyAuthentication line

#PubkeyAuthentication yes -> PubkeyAuthentication yes
or change the value from no to yes
PubkeyAuthentication no -> PubkeyAuthentication yes

Immediately following this line is the suggested path
/home/[USER]/.ssh/authorized_keys

Creating SSH Keys

In the command line on the client PC, run the commands below to generate an SSH key pair

Ed25519 (the newest and most secure)
ssh-keygen -t ed25519 -C “comment_or_email”
RSA (fallback option)
ssh-keygen -t rsa -b 4096 -C “comment_or_email”
ECDSA
ssh-keygen -t ecdsa -b 521 -C “comment_or_email”
DSA (Obsolete and insecure; may not be supported)
ssh-keygen -t dsa -C “comment_or_email”

After creating one or more SSH key pairs, check that they exist in /etc/ssh

We can see that the key pair has been successfully created. The file without the .pub extension is the private key, which must be stored in a secure location and never shared with anyone. The file with the .pub extension is the public key, which is used to configure access to the server.

You can transfer the public key to the server using any convenient method available, for example:

ssh-copy-id user@server_ip ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 2222 user@server_ip

Alternatively, when setting up the server, add the key to the SSH key field

After completing all the steps on the server, restart the SSH server
sudo systemctl restart sshd (sshd.service, ssh)
or
service sshd (sshd.service, ssh) restart

Check the connection

Connect to a Windows server

Connecting to the server

Below is an example for Windows OS

To add a key to a Windows server, you first need to install the SSH service

To do this, connect to the server using any other method (e.g., VNC) and install it using the following command in PowerShell as an administrator

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Set the SSH server to start automatically
Set-Service -Name sshd -StartupType ‘Automatic’

Next, start the sshd service
Start-Service sshd

Navigate to the C:\ProgramData\ssh\ directory
Then open the file C:\ProgramData\ssh\sshd-config, and go to the line with
#PubkeyAuthentication yes -> PubkeyAuthentication yes
and save it

Navigate to the user's directory and create the file .ssh/authorized_keys
Then, open the file and add the key that was previously generated on the client device
(ssh-keygen -t ed25519)

If the SSH key is to be assigned specifically to the Administrator user, this key must be located in
C:\ProgramData\ssh\administrators_authorized_keys

Also, set strict permissions on this file using the following commands

icacls.exe “C:\ProgramData\ssh\administrators_authorized_keys” /inheritance:r
icacls.exe “C:\ProgramData\ssh\administrators_authorized_keys” /grant “*S-1-5-32-544:F”
icacls.exe “C:\ProgramData\ssh\administrators_authorized_keys” /grant “*S-1-5-18:F”

As part of these instructions, we’ll change the firewall settings to allow traffic from all networks
Set-NetFirewallRule -Name ‘OpenSSH-Server-In-TCP’ -Profile Any

Check the connection to the server

After completing all these steps on the server, restart the SSH server