Copying SSH Key to a Headless Ubuntu Server using scp
In this article, we will discuss how to copy an SSH key from a Windows system to a headless Ubuntu server using the scp (secure copy) command. This method is an alternative to the basic ssh-copy-id command, which is not available in Windows by default. We will also cover some key concepts related to SSH keys and their importance in securing remote server access.
What is an SSH Key?
SSH keys are a pair of cryptographic keys used to authenticate a user to an SSH server. They consist of a private key, which is kept secret, and a public key, which is shared with the server. When a user attempts to connect to the server using SSH, the server will ask for the user's public key. The user's client will then use the corresponding private key to prove its identity to the server. This method of authentication is more secure than using passwords, as it is resistant to brute-force attacks and interception.
Why use scp to copy SSH Keys?
While the ssh-copy-id command is a convenient way to copy SSH keys to a remote server, it is not available in Windows by default. Instead, we can use the scp command, which is a part of the OpenSSH client package. The scp command allows us to securely transfer files between a local and a remote system using the SSH protocol. By using scp to copy our SSH key, we can ensure that our key is transferred securely and that our password authentication is disabled on the server.
Copying the SSH Key using scp
To copy the SSH key from our Windows system to the headless Ubuntu server, we will need to perform the following steps:
- Generate a new SSH key pair on our Windows system using the
ssh-keygencommand. - Locate the public key file, which will be named
id_rsa.pubby default. - Use the scp command to transfer the public key file to the remote server.
- Add the public key to the authorized\_keys file on the remote server.
Step 1: Generate a new SSH key pair
To generate a new SSH key pair on our Windows system, we can open a command prompt and enter the following command:
ssh-keygenThis will prompt us to enter a file in which to save the key. We can press enter to accept the default location and filename. We will then be prompted to enter a passphrase for the key. We can either enter a passphrase or leave it blank. If we choose to enter a passphrase, we will be prompted to enter it every time we use the key to connect to the server.
Step 2: Locate the public key file
Once we have generated the SSH key pair, we can locate the public key file by navigating to the default location, which is C:\Users\username\.ssh on most Windows systems. The public key file will be named id_rsa.pub by default.
Step 3: Transfer the public key file to the remote server
To transfer the public key file to the remote server, we can use the scp command. The syntax for the command is as follows:
scp id\_rsa.pub username@server:/path/to/authorized\_keysReplace username with our username on the remote server, server with the server's IP address or hostname, and /path/to/authorized\_keys with the path to the authorized\_keys file on the remote server. The authorized\_keys file is typically located in the ~/.ssh directory.
For example, if our username on the remote server is user, the server's IP address is 192.168.1.100, and the authorized\_keys file is located in the default location, we can use the following command:
scp id\_rsa.pub [email protected]:~/.ssh/authorized\_keysThis will transfer the public key file to the remote server and add it to the authorized\_keys file.
Step 4: Add the public key to the authorized\_keys file
If the authorized\_keys file did not already exist on the remote server, the scp command will create it for us. If the file already existed, the scp command will append the new public key to the end of the file.
We can verify that the public key has been added to the authorized\_keys file by logging in to the remote server using SSH. We should be able to log in without being prompted for a password, as long as we have not set a passphrase for the SSH key.
Disabling Password Authentication
Once we have copied our SSH key to the remote server and verified that we can log in without a password, we should disable password authentication on the server. This will prevent attackers from attempting to brute-force our password and gain access to the server.
To disable password authentication, we can edit the SSH daemon configuration file on the remote server. The file is typically located at /etc/ssh/sshd\_config.
We will need to find the line that specifies the authentication methods allowed, which will look something like this:
# Authentication:
#LoginGraceTime 2m
PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6We will need to uncomment the line that specifies PermitRootLogin and change its value to no.
We will also need to find the line that specifies PasswordAuthentication and change its value to no.
The modified configuration file should look something like this:
# Authentication:
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 6
PasswordAuthentication noOnce we have made these changes, we can save the file and restart the SSH daemon to apply the changes.
In this article, we have discussed how to copy an SSH key from a Windows system to a headless Ubuntu server using the scp command. We have also covered some key concepts related to SSH keys and their importance in securing remote server access. By following the steps outlined in this article, we can ensure that our SSH key is transferred securely and that our password authentication is disabled on the server.