Setting up host entries for
ssh is really easy and will save you a lot of trouble. Here is an example:
Host github github.com
In this example, we setup
github.com so that we can do the following commands:
If we want to login as a different user than the one specified in the config file, we just put
user@ at the begining:
ssh-keygen -t rsa -b 4096 -C user@homemachine
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): /home/user/.ssh/digitalocean-rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/digitalocean-rsa
Your public key has been saved in /home/user/.ssh/digitalocean-rsa.pub.
The key fingerprint is:
Note that I've specified the full path of the private key I want to generate when prompted by
ssh-keygen. I've also defined the comment (
-C) which allows me to easily identify keys on remote machines.
This will create two files:
- PRIVATE key. Never share this.
- Public key. This is what you store on the server to authenticate.
When you provide your
ssh key, be sure it's the
.pub version!! When you add to your
~/.ssh/config, be sure to add the correct private key that matches the public key you added to the system.
Most installations will come with Public Key Authentication enabled. If you start doing things all willy nilly, you might run into a few problems, however. At where the OP is in their problem, I recommend that the OP deletes the
/root/.ssh/ directory to start over.
It is not recommended that you use
ssh to access the root user on the remote system. It is recommended that you
ssh into another user, and then escalate to root using your password (
sudo su -).
Add keys to host using
Regardless of whether you decide to create another user and use
ssh as that user, or the root user, the following is the recommended way of placing
ssh keys on a server:
ssh-copy-id -i /home/user/.ssh/digitalocean-rsa.pub user@digitaloceanbox
sshd to create the directory and files needed with the permissions needed. This means there is zero chance for you to mess up permissions or needing to remember the details. Just use the tool to upload the keys.
Disable Password Authentication
That being said, once you have key'd yourself and verified that you are able to connect using the keys, it is recommended that you disable Password Authentication in
sshd and restart the service:
sudo systemctl restart sshd
What about new users?
If you disable Password Authentication, how can you key new users? One way is to add template files to the
/etc/skel directory. Once you've key'd one user, do the following:
sudo cp -r .ssh/ /etc/skel/
- Edit any files found in
/etc/skel/.ssh/ so that they are blank, unless you want to automatically key yourself for every newly created user.
When you create new users with
sudo useradd -m newuser, that user will have the
.ssh/authorized_keys, which you can edit and will have the proper permissions.
You can watch the
sshd log file to see why connections fail or get refused:
sudo tail -f /var/log/auth.log
While you're running this command, use another terminal to attempt a login. Many times the messages provided are good enough to help pinpoint the problem, or find a solution online.