Chapter 5. Using secure communications between two systems with OpenSSH SSH (Secure Shell) is a protocol which provides secure communications between two systems using a client-server architecture and allows users to log in to server host systems remotely. Unlike other remote communication protocols, such as FTP or Telnet, SSH encrypts the login session, which prevents intruders from collecting unencrypted passwords from the connection. 5.1. Generating SSH key pairs You can log in to an OpenSSH server without entering a password by generating an SSH key pair on a local system and copying the generated public key to the OpenSSH server. Each user who wants to create a key must run this procedure. To preserve previously generated key pairs after you reinstall the system, back up the ~/.ssh/ directory before you create new keys. After reinstalling, copy it back to your home directory. You can do this for all users on your system, including root . Prerequisites You are logged in as a user who wants to connect to the OpenSSH server by using keys. The OpenSSH server is configured to allow key-based authentication. Procedure Generate an ECDSA key pair: You can also generate an RSA key pair by using the ssh-keygen command without any parameter or an Ed25519 key pair by entering the ssh-keygen -t ed25519 command. Note that the Ed25519 algorithm is not FIPS-140-compliant, and OpenSSH does not work with Ed25519 keys in FIPS mode. Copy the public key to a remote machine: Replace <username> @ <ssh-server-example.com> with your credentials. If you do not use the ssh-agent program in your session, the command copies the most recently modified ~/.ssh/id*.pub public key if it is not yet installed. To specify another public-key file or to prioritize keys in files over keys cached in memory by ssh-agent , use the ssh-copy-id command with the -i option. Verification Log in to the OpenSSH server by using the key file: Additional resources ssh-keygen(1) and ssh-copy-id(1) man pages on your system 5.2. Setting key-based authentication as the only method on an OpenSSH server To improve system security, enforce key-based authentication by disabling password authentication on your OpenSSH server. Prerequisites The openssh-server package is installed. The sshd daemon is running on the server. You can already connect to the OpenSSH server by using a key. See the Generating SSH key pairs section for details. Procedure Open the /etc/ssh/sshd_config configuration in a text editor, for example: Change the PasswordAuthentication option to no : On a system other than a new default installation, check that the PubkeyAuthentication parameter is either not set or set to yes . Set the KbdInteractiveAuthentication directive to no . Note that the corresponding entry is commented out in the configuration file and the default value is yes . To use key-based authentication with NFS-mounted home directories, enable the use_nfs_home_dirs SELinux boolean: If you are connected remotely, not using console or out-of-band access, test the key-based login process before disabling password authentication. Reload the sshd daemon to apply the changes: Additional resources sshd_config(5) and setsebool(8) man pages on your system 5.3. Caching your SSH credentials by using ssh-agent To avoid entering a passphrase each time you initiate an SSH connection, you can use the ssh-agent utility to cache the private SSH key for a login session. If the agent is running and your keys are unlocked, you can log in to SSH servers by using these keys but without having to enter the key's password again. The private key and the passphrase remain secure. Prerequisites You have a remote host with the SSH daemon running and reachable through the network. You know the IP address or hostname and credentials to log in to the remote host. You have generated an SSH key pair with a passphrase and transferred the public key to the remote machine. See the Generating SSH key pairs section for details. Procedure Add the command for automatically starting ssh-agent in your session to the ~/.bashrc file: Open ~/.bashrc in a text editor of your choice, for example: Add the following line to the file: Save the changes, and quit the editor. Add the following line to the ~/.ssh/config file: With this option and ssh-agent started in your session, the agent prompts for a password only for the first time when you connect to a host. Verification Log in to a host which uses the corresponding public key of the cached private key in the agent, for example: Note that you did not have to enter the passphrase. 5.4. Authenticating by SSH keys stored on a smart card You can create and store ECDSA and RSA keys on a smart card and authenticate by the smart card on an OpenSSH client. Smart-card authentication replaces the default password authentication. Prerequisites On the client side, the opensc package is installed and the pcscd service is running. Procedure List all keys provided by the OpenSC PKCS #11 module including their PKCS #11 URIs and save the output to the keys.pub file: Transfer the public key to the remote server. Use the ssh-copy-id command with the keys.pub file created in the step: Connect to <ssh-server-example.com> by using the ECDSA key. You can use just a subset of the URI, which uniquely references your key, for example: Because OpenSSH uses the p11-kit-proxy wrapper and the OpenSC PKCS #11 module is registered to the p11-kit tool, you can simplify the command: If you skip the id= part of a PKCS #11 URI, OpenSSH loads all keys that are available in the proxy module. This can reduce the amount of typing required: Optional: You can use the same URI string in the ~/.ssh/config file to make the configuration permanent: The ssh client utility now automatically uses this URI and the key from the smart card. Additional resources p11-kit(8) , opensc.conf(5) , pcscd(8) , ssh(1) , and ssh-keygen(1) man pages on your system 5.5. Additional resources sshd(8) , ssh(1) , scp(1) , sftp(1) , ssh-keygen(1) , ssh-copy-id(1) , ssh_config(5) , sshd_config(5) , update-crypto-policies(8) , and crypto-policies(7) man pages on your system Configuring SELinux for applications and services with non-standard configurations Controlling network traffic using firewalld

Commands:
ssh-keygen -t ecdsa Generating public/private ecdsa key pair. Enter file in which to save the key (/home/ <username> /.ssh/id_ecdsa): Enter passphrase (empty for no passphrase): <password> Enter same passphrase again: <password> Your identification has been saved in /home/ <username> /.ssh/id_ecdsa. Your public key has been saved in /home/ <username> /.ssh/id_ecdsa.pub. The key fingerprint is: SHA256:Q/x+qms4j7PCQ0qFd09iZEFHA+SqwBKRNaU72oZfaCI <username> @ <localhost.example.com> The key's randomart image is: +---[ECDSA 256]---+ |.oo..o=++ | |.. o .oo . | |. .. o. o | |....o.+... | |o.oo.o +S . | |.=.+. .o | |E.*+. . . . | |.=..+ +.. o | | . oo*+o. | +----[SHA256]-----+
ssh-copy-id <username> @ <ssh-server-example.com> /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed <username> @ <ssh-server-example.com> 's password: ... Number of key(s) added: 1 Now try logging into the machine, with: "ssh ' <username> @ <ssh-server-example.com> '" and check to make sure that only the key(s) you wanted were added.
ssh -o PreferredAuthentications=publickey <username> @ <ssh-server-example.com>
vi /etc/ssh/sshd_config
PasswordAuthentication no
setsebool -P use_nfs_home_dirs 1
systemctl reload sshd
vi ~/.bashrc
eval USD(ssh-agent)
AddKeysToAgent yes
ssh <example.user> @ <ssh-server@example.com>
ssh-keygen -D pkcs11: > keys.pub
ssh-copy-id -f -i keys.pub <username@ssh-server-example.com>
ssh -i "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so" <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
ssh -i "pkcs11:id=%01" <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
ssh -i pkcs11: <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
cat ~/.ssh/config IdentityFile "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so" ssh <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD