# SSH

Configure secure SSH access with key-based authentication, server hardening and convenient client aliases.

---

1.  ## SSH key management (client)

    Generate unique keys for each device to improve security and auditability.

   1. ### Generate named key

             Instead of the default name, label the key after the hostname (e.g., `id_hp-laptop` or `id_macbook-pro`).

             ```sh
             ssh-keygen -t ed25519 -f ~/.ssh/id_{{HOSTNAME_VAR}}
             ```

   2. ### Copy key to server

             Use `ssh-copy-id` to automatically handle directory creation and permissions on the remote server.

             ```sh
             ssh-copy-id -i ~/.ssh/id_{{HOSTNAME_VAR}} {{USERNAME_VAR}}@{{SERVER_IP_VAR}}
             ```

2.  ## Server security (host)

    Once your key is verified, disable password logins to prevent brute-force attacks.

       

   1. ### Install SSH server

             Ensure the OpenSSH server is installed and active.

             ```sh
             sudo apt install openssh-server -y && sudo systemctl enable --now ssh
             ```

   2. ### Configure SSH daemon

             Edit the server configuration to enforce key-based authentication.

             ```sh
             sudo nano /etc/ssh/sshd_config
             ```

             ```sh title="/etc/ssh/sshd_config"
             # Disable password auth
             PasswordAuthentication no

             # Allow using SSH public/private keys
             PubkeyAuthentication yes

             # Prevent root login entirely
             PermitRootLogin no

             # Custom SSH port (optional)
             Port 2222

             # Only allow specific users (optional)
             AllowUsers {{USERNAME_VAR}} $USERNAME2 $USERNAME3
             ```

   3. ### Verify and restart

             Always check the status before exiting to ensure you aren’t locked out.

             ```sh
             sudo systemctl restart ssh && systemctl status ssh
             ```

3.  ## SSH client (local)

    Simplify your workflow by creating aliases. This allows you to type `ssh $ALIAS_NAME` instead of remembering IPs and key paths.

       

   1. ### Edit config

             Open (or create) the SSH config file on your **local** machine.

             ```sh
             nano ~/.ssh/config
             ```

   2. ### Add host alias

             Define your server details. Now you can connect using just the alias name.

             ```sh title="~/.ssh/config"
             # Default settings for all hosts
             Host *
                 ServerAliveInterval 60
                 ServerAliveCountMax 5

             # Example host
             Host {{HOSTNAME_VAR}}
                 HostName {{SERVER_IP_VAR}}
                 User {{USERNAME_VAR}}
                 Port 22
                 IdentityFile ~/.ssh/id_{{HOSTNAME_VAR}}
             ```

   3. ### Connect via alias

             Test the new configuration.

             ```sh
             ssh {{HOSTNAME_VAR}}
             ```

4.  ## SSH authorized_keys (optional)

    Use a system-wide authorized keys directory to manage SSH keys for multiple users from a single location.

       

   1. ### SSH serivce

             Ensure SSH is enabled as a system service.

             ```sh
             sudo systemctl enable ssh --now
             ```

   2. ### Global keys directory

             Create a global keys directory.

             ```sh
             sudo mkdir -p /etc/ssh/authorized_keys
             ```

   3. ### Copy authorized keys

             Copy your authorized keys file and set strict permissions.

             ```sh
             sudo cp ~/.ssh/authorized_keys /etc/ssh/authorized_keys/$USER
             ```
             ```sh
             sudo chown root:root /etc/ssh/authorized_keys/$USER
             ```
             ```sh
             sudo chmod 644 /etc/ssh/authorized_keys/$USER
             ```

   4. ### Add AuthorizedKeysFile

             Open (or create) the global SSH config file on your **local** machine.

             ```sh
             sudo nano /etc/ssh/sshd_config
             ```

             Add or update this line in config.

             ```sh title="/etc/ssh/sshd_config"
             AuthorizedKeysFile /etc/ssh/authorized_keys/%u .ssh/authorized_keys
             ```

   5. ### Restart SSH

             Test configuration and restart the SSH service.

             ```sh
             sudo sshd -t && sudo systemctl restart ssh
             ```