We have a running virtual private server called a Droplet in the Digital Ocean Cloud. In this lecture 1
I'll show you how to set up ssh public key authentication. 2
This is a more secure way to authenticate to the server 3
and you can also automate some tasks like backups using rsync because it will not prompt you for 4
the password anymore. 5
The first step is to generate a key pair. The secret key will stay on the client and the public will 6
be on the server. 7
You can generate the keys on Linux by running ssh-keygen utility or on Windows by running putty key 8
generator. 9
I'm generating the keys on Linux. 10
This is the droplet, so on the client, 11
this is the client, 12
I'm generating the key pair: ssh-keygen -t from type rsa 13
(This is a common type) -b represents the length of the keys in bits and use a minimum of 14
2048 bits 15
A capital C for a comment 16
And I'm hitting enter. This will be the private key and I'm accepting the name. I'm hitting enter because 17
I don't want to use the passphrase for the private key. 18
And it's done. The private and the public were generated and located in the dat.ssh directory from 19
the user's home directory. 20
This is the private key and this is the public key; the private key and the public. The next step is to 21
add the public key to your droplet. On digital ocean 22
you can upload your ssh public key to your account, which lets you add it to your Droplets at creation 23
time. To add an SSH public key to your DigitalOcean account, log in to the control panel and then go to settings. 24
Click security 25
And add ssh keys, and here paste your public ssh key 26
Now, I'll add an ssh public key to an existing droplet to be able to log in using that key pair. 27
So this is only for the new droplets you'll create. 28
At the moment, I have password based access to the server. 29
This is the server in the Digital Ocean cloud and this is the client, the local client. 30
I'm copying the public key to the corresponding location on the server by running a utility called ssh 31
copyid so ssh copy id the username, root @ and the IP address of the server. 32
It's prompting me for the root password, and after typing in the password, the contents of the public key 33
will be appended to the authorized keys file. 34
Let's check that the public key was appended to the authorized key file. 35
So this is the public key, on the client, and I'm chacking it on the server. 36
So cat.ssh authorized keys and it's there; the public key is on the server. And that's all! 37
Now, I should be able to authenticate the server using the keys. 38
So ssh root @ and the IP address of the server. 39
And I'm in. 40
The public view authentication is working. 41
I'd also recommend you to disable password authentication on the server so that it permits only public key 42
authentication. 43
This is more secure. 44
So I'm opening the configuration file of the ssh.daemon and changing the password authentication 45
option to No: so vim /etc/ ssh/sshd_config. 46
This is the configuration file of the ssh daemon, and I'm looking for password authentication. OK! 47
It's YES and I'm changing it to NO. I'm saving the file and restarting the server; 48
the ssh daemon: systemctl restart ssh and that's all. 49
Now it allows you to login only using the key pair!