Centos Generate Ssh Host Keys

13.12.2020 admin

Centos Generate Ssh Host Keys List
Centos Generate Ssh Host Keys On Computer

<<TableOfContents: execution failed [Argument 'maxdepth' must be an integer value, not '[1]'] (see also the log)>>

SSH host keys are stored in /etc/ssh/, which you generally do not need to choose. These keys were generated when the openssh-server package was installed. You can list the fingerprint of the keys by ssh-keygen -l -f /etc/ssh/sshhostkey.pub though you will need to repeat this for each public key. Dec 18, 2019 Disabling SSH Password Authentication #. Log into your remote server: ssh sudouser@serveripaddress. Open the SSH configuration file /etc/ssh/sshdconfig with your text editor: sudo nano /etc/ssh/sshdconfig. Search for the following directives and modify as it follows: /etc/ssh/sshdconfig. Apr 02, 2019 SSH keys offer a highly secure manner of logging into a server with SSH as against mere dependence on a password. While a password stands the risk of being finally cracked, SSH keys are rather impossible to decipher using brute force. With the following commands, you can generate ssh key. Run: ssh-keygen -t rsa. For a more secure 4096-bit key, run: ssh-keygen -t rsa -b 4096 Press enter when asked where you want to save the key (this will use the default location). Enter a passphrase for your key. We’ll show you, how to set up SSH Keys on CentOS 7. SSH (Secure Socket Shell) is an open source, UNIX based, network protocol that provides users with a secure and encrypted way to login to remote computers, transfer files securely between the computers (SCP), command execution on remote servers, automate tasks between multiple servers on the network, and much more. Mar 28, 2020 ssh-keysign is used by ssh to access the local host keys and generate the digital signature required during host based authentication Only public and private key pair matching is performed for SSH public key Authentication.

The ssh-keygen program can be used for generating additional host keys or for replacing existing keys. Known Host Keys. SSH clients store host keys for hosts they have ever connected to. These stored host keys are called known host keys, and the collection is often called known hosts.

OpenSSH (or Secure SHell) has become a de facto standard for remote access replacing the telnet protocol. SSH has made protocols such as telnet redundant due, in most part, to the fact that the connection is encrypted and passwords are no longer sent in plain text for all to see.

However, a default installation of ssh isn't perfect, and when running an ssh server there are a few simple steps that can dramatically harden an installation.

1. Use Strong Passwords/Usernames

One of the first things you'll notice if you have ssh running and exposed to the outside world is that you'll probably log attempts by hackers to guess your username/password. Typically a hacker will scan for port 22 (the default port on which ssh listens) to find machines with ssh running, and then attempt a brute-force attack against it. With strong passwords in place, hopefully any attack will be logged and noticed before it can succeed.

Hopefully you already use strong passwords, but if you are not then try to choose passwords that contains:

Minimum of 8 characters
Mix of upper and lower case letters
Mix of letters and numbers
Non alphanumeric characters (e.g. special characters such as ! ' £ $ % ^ etc)

The benefits of strong passwords aren't specific to ssh, but have an impact on all aspects of systems security. Further information on passwords can be found in the CentOS documentation:

http://www.centos.org/docs/4/html/rhel-sg-en-4/s1-wstation-pass.html

If you absolutely can't prevent your users choosing weak passwords, then consider using randomly generated or difficult to guess usernames for your user accounts. If the bad guys can't guess the username then they can't brute force the password. However, this is still security through obscurity and be aware of information leakage of usernames from things such as email sent from user accounts.

2. Disable Root Logins

SSH server settings are stored in the /etc/ssh/sshd_config file. To disable root logins, make sure you have the following entry:

and restart the sshd service:

If you need root access, login as a normal user and use the su command.

3. Limit User Logins

SSH logins can be limited to only certain users who need remote access. If you have many user accounts on the system then it makes sense to limit remote access to only those that really need it thus limiting the impact of a casual user having a weak password. Add an AllowUsers line followed by a space separated list of usernames to /etc/ssh/sshd_config For example:

and restart the sshd service.

4. Disable Protocol 1

SSH has two protocols it may use, protocol 1 and protocol 2. The older protocol 1 is less secure and should be disabled unless you know that you specifically require it. Look for the following line in the /etc/ssh/sshd_config file, uncomment it and amend as shown:

and restart the sshd service.

5. Use a Non-Standard Port

By default, ssh listens for incoming connections on port 22. For a hacker to determine ssh is running on your machine, he'll most likely scan port 22 to determine this. An effective method is to run ssh on a non-standard port. Any unused port will do, although one above 1024 is preferable. Many people choose 2222 as an alternative port (as it's easy to remember), just as 8080 is often known as the alternative HTTP port. For this very reason, it's probably not the best choice, as any hacker scanning port 22 will likely also be scanning port 2222 just for good measure. It's better to pick some random high port that's not used for any known services. To make the change, add a line like this to your /etc/ssh/sshd_config file:

and restart the sshd service. Don't forget to then make any necessary changes to port forwarding in your router and any applicable firewall rules. For example on CentOS 7 (and higher) you can change firewalld's ssh service by making a duplicate of its service file in /etc/firewalld/ and changing its port line:

Then change the port line in /etc/firewalld/services/ssh-custom.xml so the port is the same as in the ssh config file:

Lastly, remove the ssh service, add the ssh-custom service, and reload firewalld for the change to take effect:

Or on CentOS 6, add an iptable rule to open the new ssh port:

Don't forget to close the old port as well.

On CentOS 6 and above you should also update selinux, labeling the chosen port correctly, otherwise sshd will be prevented from accessing it. For example:

Because ssh is no longer listening for connections on the standard port, you will need to tell your client what port to connect on. Using the ssh client from the command line, we may specify the port using the -p switch:

or if you are using the fish protocol in konqueror, for example:

If you are thinking that this sounds like a pain having to specify the port each time you connect, simply add an entry specifying the port in your local ~/.ssh/config file:

And the file: ~/.ssh/config must have the following permissions:

6. Filter SSH at the Firewall

If you only need remote access from one IP address (say from work to your home server), then consider filtering connections at your firewall by either adding a firewall rule on your router or in iptables to limit access on port 22 to only that specific IP address. For example, in iptables this could be achieved with the following type of rule for iptables (CentOS 6):

or using firwalld (CentOS 7) use rich-rules to allow ssh on only a specific port. The source address may be a single address or a base address with a bitmask:

SSH also natively supports TCP wrappers and access to the ssh service may be similarly controlled using hosts.allow and hosts.deny.

If you are unable to limit source IP addresses, and must open the ssh port globally, then iptables can still help prevent brute-force attacks by logging and blocking repeated attempts to login from the same IP address. For example, with iptables

The first rule records the IP address of each new attempt to access port 22 using the recent module. The second rule checks to see if that IP address has attempted to connect 4 or more times within the last 60 seconds, and if not then the packet is accepted. Note this rule would require a default policy of DROP on the input chain.

Don't forget to change the port as appropriate if you are running ssh on a non-standard port. Where possible, filtering at the firewall is an extremely effective method of securing access to an ssh server.

For systems using the FirewallD service (CentOS 7 or higher), use firewall-cmd:

The first command removes the more permissive service rule, the second instates a rule to accept only 4 connections in a minute and log all connections.

7. Use Public/Private Keys for Authentication

Using encrypted keys for authentication offers two main benefits. Firstly, it is convenient as you no longer need to enter a password (unless you encrypt your keys with password protection) if you use public/private keys. Secondly, once public/private key pair authentication has been set up on the server, you can disable password authentication completely meaning that without an authorized key you can't gain access - so no more password cracking attempts.

It's a relatively simple process to create a public/private key pair and install them for use on your ssh server.

First, create a public/private key pair on the client that you will use to connect to the server (you will need to do this from each client machine from which you connect):

This will create two files in your (hidden) ~/.ssh directory called: id_rsa and id_rsa.pub The first: id_rsa is your private key and the other: id_rsa.pub is your public key.

If you don't want to still be asked for a passphrase (which is basically a password to unlock a given public key) each time you connect, just press enter when asked for a passphrase when creating the key pair. It is up to you to decide whether or not you should add the passphrase protective encryption to your key when you create it. If you don't passphrase protect your key, then anyone gaining access to your local machine will automatically have ssh access to the remote server. Also, root on the local machine has access to your keys although one assumes that if you can't trust root (or root is compromised) then you're in real trouble. Encrypting the key adds additional security at the expense of eliminating the need for entering a password for the ssh server only to be replaced with entering a passphrase for the use of the key. This may be further simplified by the use of the ssh_agent program

Now set permissions on your private key:

Copy the public key (id_rsa.pub) to the server and install it to the authorized_keys list:

Note: once you've imported the public key, you can delete it from the server.

and finally set file permissions on the server:

The above permissions are required if StrictModes is set to yes in /etc/ssh/sshd_config (the default).

Ensure the correct SELinux contexts are set:

Now when you login to the server you won't be prompted for a password (unless you entered a passphrase when you created your key pair). By default, ssh will first try to authenticate using keys. If no keys are found or authentication fails, then ssh will fall back to conventional password authentication.

Once you've checked you can successfully login to the server using your public/private key pair, you can disable password authentication completely by adding the following setting to your /etc/ssh/sshd_config file:

8. Frequently Asked Question (FAQ)

Q: CentOS uses version X of OpenSSH and the latest version is version Y. Version X contained a serious security flaw, should I upgrade?

A: No. The Upstream Vendor has a policy of backporting security patches from the latest releases into the current distribution version. As long as you have the latest updates applied for your CentOS distribution you are fully patched. See here for further details of backporting security patches:

http://www.redhat.com/advice/speaks_backport.html

Q: How to I get ssh to allow passwordless key based authentication between machines that share users' home directories by NFS?

A: SElinux blocks root access to NFS shared directories and files that are not world readable by default and so sshd can't read users' key files in ~/.ssh. To enable access, change the setting of use_nfs_home_dirs by running the following command as the superuser:

https://www.centos.org/forums/viewtopic.php?t=49194

9. Links

http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-openssh.html

http://www.dragonresearchgroup.org/insight/sshpwauth-tac.html

I am a new RHEL 8 server sysadmin. How do I configure SSH public key-based authentication for RHEL (Red Hat Enterprise Linux) 8 server?
Introduction – SSH is an acronym for secure shell. It is a suite of cryptographic network protocol. It allows users to log in and transfer files securely over the unsecure network such as the Internet. OpenSSH is an implementation of SSH protocol on RHEL 8. You can log in using RHEL 8 user and password account. However, OpenSSH project recommends log in using a combination of a private and public SSH keys.

Sample set up for our RHEL 8 server

Where,

You generate a key pair on your Linux/Unix/macOS desktop.
Place the public key on RHEL 8 server.
One can unlock public key using a private key stored on your desktop with the help of ssh command.
When both the public and private key correct you can log in without a password.

How do I set up SSH keys on RHEL 8 server?

The procedure to set up SSH key on Red Hat Enteprise Linux 8 server:

On your local desktop type:
ssh-keygen
Install public key into remote RHEL 8 server using:
ssh-copy-id user@remote-RHEL8-server-ip
Use ssh for password less login:
ssh user@remote-RHEL8-server-ip

Let us see all commands and steps in details.

How to create the ed25519 or RSA key pair

The syntax is:
ssh-keygen -t ed25519 ssh-keygen -t rsa ssh-keygen -t rsa -b 4096 -f ~/.ssh/aws-lighsail.key -C 'My AWS SSH Keys' ssh-keygen -t ed25519 -f ~/.ssh/linode-usa-www1-vps.key -C 'My Linode SSH Keys for www'
Where,

-t rsa OR -t ed25519 : Specifies the type of key to create. The possible values “dsa”, “ecdsa”, “ed25519”, or “rsa” for SSH protocol version 2.
-b 4096 : Specifies the number of bits in the key to create.
-f~/.ssh/aws-lighsail.key : Specifies the filename of the key file.
-C -C 'My AWS SSH Keys' : Set a new comment.

I am going type the following command on my Ubuntu desktop to create the key pair:
$ ssh-keygen -t ed25519
I strongly recommend that you set up a passphrase when prompted.

How to copy the public key

Now our key paid generated and stored in ~/.ssh/ directory. You must copy a public SSH key file named ~/.ssh/id_ed25519.pub (or ~/.ssh/id_rsa.pub if you created RSA key) to the RHEL 8 server. Try the ssh-copy-id command as follows:
$ ssh-copy-id -i ~/.ssh/fileNameHere.pubuser@remote-RHEL8-server-ip
For example:
$ ssh-copy-id -i ~/.ssh/id_ed25519.pub vivek@192.168.2.211

How to log in using ssh and without a password

Now try logging into the machine, with the ssh command as follows:
$ ssh user@rhel-8-server $ ssh vivek@192.168.2.211
You should be able to log in without a password. If you set up a passphrase, unlock it as follows for your current session so that you don’t have to enter it every time you run ssh, sftp, scp, rsync and other commands:
$ ssh-agent $SHELL $ ssh-add

Optional settings for root user

Disable root user log in all together on RHEL 8 via ssh. Log in as root user on RHEL 8 and run following to add a user named vivek to wheel group:
# usermod -aG wheel vivek # id vivek
Allows users in group wheel can use sudo command to run all commands on RHEL 8 server. Next disable root user login by adding the following line to sshd_config:
# vi /etc/ssh/sshd_config
Disable the password for root login and only allow ssh keys based login: