How to configure an Ubuntu Linux server to allow SSH sessions only with a key and disable password-based
Tags: commandline, linux, security, ssh
Published: 2023-11-29 20:36:03

---
title: How to configure an Ubuntu Linux server to allow SSH sessions only with a key and disable password-based
published: true
date: 2023-11-16 09:12:35 UTC
tags: commandline,linux,security,ssh
canonical_url: https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/
---

- [Context](https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/#context)
  - [What is an SSH key and why is it more secure?](https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/#what-is-an-ssh-key-and-why-is-it-more-secure)
- [Steps to configure the server](https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/#steps-to-configure-the-server)
  - [1. Create an SSH Key Pair (if you don't have one)](https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/#1-create-an-ssh-key-pair-if-you-dont-have-one)
  - [2. Copy the public key to the server](https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/#2-copy-the-public-key-to-the-server)
  - [3. Test the configuration](https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/#3-test-the-configuration)
  - [4. Configure the server to only allow SSH sessions with a key and disable password-based authentication](https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/#4-configure-the-server-to-only-allow-ssh-sessions-with-a-key-and-disable-password-based-authentication)
  - [5. Restart the SSH service](https://diegocarrasco.com/how-to-configure-a-linux-server-to-allow-ssh-sessions-only-with-a-key-and-disable-password-based-authentication/#5-restart-the-ssh-service)

## Context

I have a server running Ubuntu 22.04 LTS which I use for some personal projects and I wanted to make it more secure by only allowing SSH sessions with a key and disabling password-based authentication.

### What is an SSH key and why is it more secure?

SSH keys are a pair of cryptographic keys which are used to authenticate to an SSH server. When you generate the key, 2 files are created. There is a private key (kept in the client) and a public key `.pub` (added to the server). The private key is used to encrypt the data and the public key is used to decrypt it.

## Steps to configure the server

### 1. Create an SSH Key Pair (if you don't have one)

On your local machine, run the following command to generate a new SSH key pair. (You can use the default values)

```
ssh-keygen -t rsa -b 4096 -C "your\_email@example.com"

```

**Notes:**

- The email is used as a label for the key. You can use any email you want.
- If you want additional security, add a passphrase to the key. (You will need to enter the passphrase each time you use the key). -- There are different views on whether this is a good idea or not. I think it is a good idea, but it is up to you. -- You can skip this step by pressing enter twice.
- The default key name is `id_rsa`. You can use a different name if you want.
- The default location is `~/.ssh`. You can use a different location if you want.
- The default permissions are `600` for the private key. (I have a quick-note about permissions at [(Quick-note) SSH Keys Permissions](https://diegocarrasco.com/quick-note-ssh-keys-permissions/)

### 2. Copy the public key to the server

```
ssh-copy-id <username>@<server_ip>

```

If you have more than one key (identity), you can specify the key to use with the `-i` flag. (The default is `~/.
ssh/id_rsa.pub`)

**Alternative:**

You can also add the public key to the server manually. (This is useful if you don't have `ssh-copy-id` installed)

```
cat ~/.ssh/id_rsa.pub | ssh <username>@<server_ip> "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized\_keys"

```

or just copy the contents of the public key `.pub` and paste it in the `~/.ssh/authorized_keys` file on the server.

```
ssh-copy-id -i ~/.ssh/id_rsa.pub <username>@<server_ip>

```

### 3. Test the configuration

Check if you can access the server with the key. If you are using the default key, you don't need to specify it.

```
ssh <username>@<server_ip>

```

If you are using a different key, you need to specify it with the `-i` flag.

```
ssh -i ~/.ssh/<key_name> <username>@<server_ip>

```

If you can access the server, you can continue with the next steps. If not, check the logs in `/var/log/auth.log` to find out what is wrong. (You can use `tail -f /var/log/auth.log` to see the logs in real time)

### 4. Configure the server to only allow SSH sessions with a key and disable password-based authentication

Edit the `/etc/ssh/sshd_config` file:

```
sudo nano /etc/ssh/sshd_config

```

And add or edit the following line:

```
PasswordAuthentication no

```

### 5. Restart the SSH service

```
sudo systemctl restart ssh

```

or, if you are using an older version of Ubuntu

```
sudo service ssh restart

```

You have now configured your server to allow ssh sessions only with a key 😁

<!--
5. Disable password-based authentication for all users

6. (Optional) Disable root login
7. (Optional) Disable password-based authentication for specific users
8. (Optional) Disable password-based authentication for specific groups
9. (Optional) Disable password-based authentication for specific users and groups
-->