How to Configure SSH Key Authentication on Linux Server

Homepage > Blog > Linux Server SSH Key Authentication Configuration

SSH Key Authentication (SSH 密钥认证) vs. Password Authentication

Using SSH key authentication (SSH 密钥认证) is a more secure way to connect to a server compared to using a password. The principle is: you generate a pair of keys (a public key and a private key) on your client machine, and then place the public key on the server. When connecting, the server verifies the private key to confirm your identity.

The advantages include:

• Stronger security: A properly configured SSH key is almost impossible to crack.
• Convenience: You don't need to enter a password every time you connect.

Step 1: Generate an SSH Key Pair (客户端生成密钥对)

First, you need to generate a key pair on your local machine (client). Open a terminal and run the following command:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

• -t rsa: Specifies the key type as RSA.
• -b 4096: Specifies the key length as 4096 bits, which is highly secure.
• -C "your_email@example.com": Adds a comment, typically an email address, to help identify the key.

The system will prompt you to enter a file location to save the key. Press Enter to use the default path (~/.ssh/id_rsa). Then, you will be asked to enter a passphrase (密码短语). You can set one for extra security or press Enter to leave it empty.

After completion, two files will be generated in the ~/.ssh/ directory:

• id_rsa: Your private key. Keep it safe and never share it.
• id_rsa.pub: Your public key. This is the file you need to upload to the server.

Step 2: Upload the Public Key to the Server (将公钥上传到服务器)

You need to append the content of your public key (id_rsa.pub) to the ~/.ssh/authorized_keys file on the server.

Method 1: Using the ssh-copy-id command (recommended)

ssh-copy-id username@server_ip

This command will automatically handle the copying and setting the correct permissions.

Method 2: Manually copying

1. Display the public key content on your local machine:

   cat ~/.ssh/id_rsa.pub
   

2. Copy the entire output.
3. Log in to the server using your password (or another method) and edit (or create) the authorized_keys file:

   mkdir -p ~/.ssh
   chmod 700 ~/.ssh
   nano ~/.ssh/authorized_keys
   

4. Paste the public key content into this file and save it.
5. Set the correct file permissions:

   chmod 600 ~/.ssh/authorized_keys
   

Step 3: Test the Connection (测试连接)

Now, try to log in to the server from your client:

ssh username@server_ip

If you set a passphrase, you will be prompted to enter it. Otherwise, you should be logged in directly without a password.

Step 4 (Optional but Recommended): Disable Password Authentication (禁用密码认证)

To fully utilize the security advantage of key authentication, you can disable password authentication on the server. This prevents brute-force password attacks.

1. Edit the SSH daemon configuration file:

   sudo nano /etc/ssh/sshd_config
   

2. Find the PasswordAuthentication line and change it to:

   PasswordAuthentication no
   

3. You may also want to ensure PubkeyAuthentication is set to yes:

   PubkeyAuthentication yes
   

4. Restart the SSH service to apply changes:

   sudo systemctl restart sshd
   

Important: Make sure your SSH key authentication is working correctly before disabling password authentication, or you may lock yourself out of the server.

Conclusion (总结)

You have now successfully configured SSH key authentication (SSH 密钥认证) for your Linux server. This setup significantly enhances security and login convenience. Remember to keep your private key file (id_rsa) secure at all times.