{"id":423,"date":"2020-10-15T01:31:06","date_gmt":"2020-10-15T01:31:06","guid":{"rendered":"https:\/\/dft.wiki\/?p=423"},"modified":"2025-11-20T18:06:00","modified_gmt":"2025-11-20T23:06:00","slug":"ssh-keys-to-access-your-server","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=423","title":{"rendered":"Setting Up and Copying SSH Keys"},"content":{"rendered":"

Creating a key to have access to your server through ssh is the safest way to get access to your server.<\/p>\n

In your client machine just type:<\/p>\n

ssh-keygen -t rsa-sha2-512 -b 4096 -C \"user@domain.com\"<\/pre>\n
Or, for an elliptic curve signing algorithm alternative:<\/p>\n
ssh-keygen -t ed25519 -C \"user@domain.com\"<\/pre>\n
It is going to ask you the location, just hit “Enter”, and if you want a password just type, confirm, and the key is created.<\/p>\n
When needed to change the password of the private key issue:<\/p>\n
ssh-keygen -p -f ~\/.ssh\/id_dsa<\/pre>\n
Or simply:<\/p>\n
ssh-keygen -p<\/pre>\n
For manually extract the public key from the private:<\/p>\n
ssh-keygen -y -f ~\/.ssh\/id_rsa > ~\/.ssh\/id_rsa.pub<\/pre>\n
The whole directory must be protected from being read by other users:<\/p>\n
chmod 700 -R ~\/.ssh<\/pre>\n
To transfer your key to the server issue the command:<\/p>\n
ssh-copy-id user@domain.com<\/pre>\n
Confirm the password that you used to type to log in to your server.<\/p>\n
The public key can be manually installed by appending the id_rsa.pub<\/strong> into the authorized_keys<\/strong>.<\/p>\n
cat ~\/.ssh\/id_rsa.pub >> ~\/.ssh\/authorized_keys<\/pre>\n
To check the algorithm type of an existent key:<\/p>\n
ssh-keygen -l -f ~\/.ssh\/id_rsa<\/pre>\n
Done!<\/strong> Now just try to connect again.<\/p>\n
ssh domain.com<\/pre>\n
If you did everything correctly you are already logged in.<\/p>\n
It is always a good idea to have another account set just in case you type something wrong and lock yourself out. If this is the case, log in with the second account, switch to your user, or root, and delete the files inside the folder ~\/.ssh\/.<\/p>\n
As a good practice, always protect your SSH as much as you can. See the recommendations below:<\/p>\n
sudo nano \/etc\/ssh\/sshd_config<\/pre>\n
Configuration parameters you should pay attention to:<\/p>\n
AllowUsers user<\/strong>\r\nPermitRootLogin no\r\nPubkeyAuthentication yes\r\nPasswordAuthentication no\r\nPermitEmptyPasswords no<\/pre>\n
Replace “user<\/strong>” with your own user id.\u00a0Restart your server:<\/p>\n
sudo systemctl restart sshd.service<\/pre>\n
Consider using an SSHFP<\/strong> (SSH FingerPrint) record in your DNS<\/strong> zone. It will require the following information.<\/span><\/p>\n