SSH Key Authentication Configuration

SSH provides password authentication by default, but for enhanced security, key-based authentication is recommended.

This post explains how to configure SSH key authentication from a Mac client to an Arch Linux server.

Prerequisites

#

Ensure that SSH password authentication is already set up. If not, refer to Basic SSH Configuration.

Generating SSH Keys

#

Create the ~/.ssh Directory on the Client

#

Open a terminal on client PC and verify if the ~/.ssh directory exists:

ls -la

If the directory does not exist, create it and set the appropriate permissions:

mkdir ~/.ssh
chmod 700 ~/.ssh

Generate SSH Key Pair

#

Ed25519 is recommended for security and efficiency. Generate the key pair using:

ssh-keygen -t ed25519

When prompted:

• Press Enter to accept the default file location (~/.ssh/id_ed25519).
• Enter a passphrase for added security.

Verify that the generated keys (id_ed25519 (private key) and id_ed25519.pub (public key)) exist:

ls ~/.ssh

Deploying the Public Key to the Server

#

Create the Authorized Keys File on the Server

#

Log in to the server using SSH with password authentication:

ssh -p <PORT> <USER>@<SERVER_IP>

Create the ~/.ssh directory and authorized_keys file if they do not exist:

mkdir ~/.ssh
chmod 700 ~/.ssh
touch ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
exit

Transfer the Public Key

#

Use scp to securely copy the public key from the client to the server:

scp -P <PORT> ~/.ssh/id_ed25519.pub <USER>@<SERVER_IP>:.ssh/

Then, log in to the server and append the public key to authorized_keys:

ssh -p <PORT> <USER>@<SERVER_IP>
cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
rm -rf ~/.ssh/id_ed25519.pub
exit

Verifying SSH Key Authentication

#

Attempt to connect using key authentication:

ssh -p <PORT> <USER>@<SERVER_IP>

Enter the passphrase if prompted.

Disabling Password Authentication

#

Modify the SSH Daemon Configuration

#

Edit the SSH daemon configuration on the server:

sudo vim /etc/ssh/sshd_config

Set the following options:

PasswordAuthentication no
ChallengeResponseAuthentication no

Restart the SSH Service

#

Apply the changes by restarting SSH:

sudo systemctl restart sshd.service

Confirm Password Authentication is Disabled

#

Before logging out of the server, open a new terminal on the client and attempt to SSH without the key:

ssh -p <PORT> <USER>@<SERVER_IP>

If password authentication is disabled correctly, you should see:

Permission denied (publickey).

Then, try logging in with the key authentication by entering the passphrase when prompted.

Appendix

#

To simplify SSH connections, consider configuring an alias in ~/.ssh/config. For details, refer to Managing SSH Connections with ~/.ssh/config.