How do I secure SSH access to Linux servers using key-based authentication?

Securing SSH access using key-based authentication is an essential practice for enhancing the security of Linux servers. This method is more secure and convenient than password-based authentication. Here’s a step-by-step guide:

---

Step 1: Generate SSH Key Pair

1. On your local machine, open a terminal and generate an SSH key pair:
   bash
ssh-keygen -t rsa -b 4096
2. -t rsa: Specifies the type of key (RSA is commonly used).

3. -b 4096: Sets the key size to 4096 bits for increased security.

4. You will be prompted to:

5. Choose a file name for the key pair (default is ~/.ssh/id_rsa).
6. Set a passphrase for the private key (optional but recommended for added security).

---

Step 2: Copy the Public Key to the Server

You need to transfer the public key (id_rsa.pub) to the server.

1. Use the ssh-copy-id command to copy the public key to the remote server:
   bash
ssh-copy-id username@server_ip
2. Replace username with your server username.
3. Replace server_ip with the server’s IP address or hostname.

Alternatively, if ssh-copy-id is unavailable, you can manually copy the key:
– View the public key on your local machine:
bash
cat ~/.ssh/id_rsa.pub
– Log in to the server using your current authentication method and append the public key to the ~/.ssh/authorized_keys file:
bash
echo "your_public_key_contents" >> ~/.ssh/authorized_keys
– Ensure the permissions are set correctly:
bash
chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh

---

Step 3: Disable Password-Based Authentication

Disabling password authentication ensures that only key-based authentication is allowed.

1. Edit the SSH configuration file on the server:
   bash
sudo nano /etc/ssh/sshd_config
2. Locate and modify the following lines:
   plaintext
PasswordAuthentication no
ChallengeResponseAuthentication no
3. Save the file and restart the SSH service:
   bash
sudo systemctl restart sshd

---

Step 4: Restrict SSH Access

For added security:
1. Restrict SSH to a specific user or group:
– Edit /etc/ssh/sshd_config and add:
plaintext
AllowUsers username
Replace username with the allowed user(s).
– Alternatively, use AllowGroups to restrict access to a specific group.

1. Change the default SSH port:
2. Change the default SSH port (22) to a custom port:
   plaintext
Port 2222

3. Update your firewall and any monitoring tools to accommodate this change.

4. Enable Fail2Ban:

5. Install and configure fail2ban to block IPs after multiple failed login attempts:
   bash
sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

6. Disable root login:

7. Edit /etc/ssh/sshd_config and set:
   plaintext
PermitRootLogin no
8. Instead, use a regular user account and escalate privileges with sudo.

---

Step 5: Test the Configuration

1. Open a new terminal and attempt to log in using your SSH key:
   bash
ssh -i ~/.ssh/id_rsa username@server_ip
2. Verify that you can no longer log in using a password.

---

Step 6: Monitor and Audit

1. Regularly check SSH logs for unauthorized access attempts:
   bash
sudo cat /var/log/auth.log | grep sshd
2. Implement intrusion detection systems (IDS) for real-time monitoring.

---

By following these steps, you can secure SSH access to your Linux servers effectively. Always keep your private key safe and consider implementing additional layers of security, such as firewalls or VPNs, for critical infrastructure.