RH124 Ch 10: Configuring and Securing SSH

SSH gives an encrypted shell on another machine: ssh user@host, or ssh host command to run one command. On first contact you accept the server's host key; it is stored in ~/.ssh/knownhosts, and a changed key later triggers a warning worth taking seriously.

Key-based login 1. ssh-keygen -t ed25519 creates ~/.ssh/ided25519 (private, keep it 600) and ided25519.pub (public). 2. ssh-copy-id user@host appends the public key to the remote ~/.ssh/authorizedkeys (dir 700, file 600 — sshd ignores keys with loose permissions). 3. ssh user@host now logs in without the account password. A passphrase protects the key itself; ssh-agent + ssh-add cache it.

Client settings in ~/.ssh/config: Host sb HostName serverb User student

Server settings in /etc/ssh/sshdconfig or /etc/ssh/sshdconfig.d/.conf: - PermitRootLogin no (or prohibit-password to allow root by key only). - PasswordAuthentication no — keys only. Set up your own key first! - The first value sshd reads wins, and drop-in files are included near the top of sshdconfig. - sshd -t checks syntax, sshd -T prints the effective settings, then systemctl reload sshd.

Exam traps: wrong ownership on ~/.ssh; editing the client file sshconfig instead of sshdconfig; forgetting to reload sshd; locking yourself out by disabling passwords before testing a key.