> For the complete documentation index, see [llms.txt](https://kchuene.gitbook.io/data-communication-project/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kchuene.gitbook.io/data-communication-project/tuning-and-security/ssh-public-key-auth.md).

# SSH Public-Key Auth

Configuring public key authentication on production node's ssh service for extra security AND to divert attention to the weaker Cowrie SSH honeypot.

## Key Generation and Authorization

**Generate RSA public and private key pair**

{% code overflow="wrap" lineNumbers="true" %}

```
ssh-keygen -t ed25519
```

{% endcode %}

For default setting, the files `id_ed25519` (Private Key) and `id_ed25519.pub` (Public Key) will be saved to the user home at `/home/<username>/.ssh/`.

{% hint style="info" %}
You can also provide a passphrase to lock the private key when prompted by **ssh-keygen**.
{% endhint %}

**Copy the Public Key to the SSH Server for authorization and later communication**

{% code overflow="wrap" lineNumbers="true" %}

```
ssh-copy-id -i /home/main/.ssh/id_ed25519.pub prod-admin@192.168.56.101
```

{% endcode %}

After login, the Public Key will be save to an `authorized_keys` file, by default located at `~/.ssh` for the specific user, i.e. `prod-admin`.

{% hint style="info" %}
`ED25519` offers greater security and and speeds than `RSA` , and is the default used if no algorithm is specified.
{% endhint %}

## Enable Public-Key Auth

**Enable Public Key auth and disable password auth**

On the **SSH Server** edit the SSH config file `/etc/ssh/sshd_config.d/50-cloud-init.conf` with the following lines

{% code overflow="wrap" lineNumbers="true" %}

```ssh-config
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no
```

{% endcode %}

Note that we set `PasswordAuthentication` to `no` .

**Restart SSH Service**

{% code overflow="wrap" lineNumbers="true" %}

```
sudo systemctl restart ssh
```

{% endcode %}

## Add Private-Key to SSH Agent

This is an optional step for convenience, so that you don't have to specify the private key when attempting to login to the SSH server

{% code overflow="wrap" lineNumbers="true" %}

```
ssh-add ~/.ssh/id_ed25519
```

{% endcode %}

This adds the key to an **ssh-agent** which will maintain the key in memory, automating authentication for sessions that require the key. After which you can access service with the command

{% code overflow="wrap" lineNumbers="true" %}

```
ssh prod-admin@192.168.56.101
```

{% endcode %}

OR (Manually)

{% code overflow="wrap" lineNumbers="true" %}

```
ssh -i ~/.ssh/id_ed25519 prod-admin@192.168.56.101 
```

{% endcode %}

{% embed url="<https://linux.die.net/man/1/ssh-agent>" %}

{% embed url="<https://www.youtube.com/watch?v=Or3Sm_COFUY>" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://kchuene.gitbook.io/data-communication-project/tuning-and-security/ssh-public-key-auth.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.