Red Hat System Administration I

Generate SSH keys on desktopX, copy the public key to the student account on serverX, and verify that the keys are working.

1. Generate the SSH keys on desktopX.

   [student@desktopX ~]$ ssh-keygen
   Generating public/private rsa key pair.
   Enter file in which to save the key (/home/student/.ssh/id_rsa): 
                     Enter
                   
   Created directory '/home/student/.ssh'.
   Enter passphrase (empty for no passphrase): Enter
   Enter same passphrase again: Enter
   Your identification has been saved in /home/student/.ssh/id_rsa.
   Your public key has been saved in /home/student/.ssh/id_rsa.pub.
   ...
                 

2. Copy the SSH public key to the student account on serverX.

   [student@desktopX ~]$ ssh-copy-id serverX
   The authenticity of host 'serverX (172.25.X.11)' can't be established.
   ECDSA key fingerprint is 33:fa:a1:3c:98:30:ff:f6:d4:99:00:4e:7f:84:3e:c3.
   Are you sure you want to continue connecting (yes/no)? yes
   
   /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
   /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
   student@serverX's password: student
   
   Number of key(s) added: 1
   
   Now try logging into the machine, with:   "ssh 'student@serverX'"
   and check to make sure that only the key(s) you wanted were added.
   

3. Verify that key-based SSH authentication is working for user student on serverX.

   [student@desktopX ~]$ ssh student@serverX
   [student@serverX ~]$ 
   

Log into the serverX machine and obtain superuser privileges.

[student@desktopX ~]$ ssh student@serverX
[student@serverX ~]$ su -
Password: redhat
[root@serverX ~]# 

Configure SSH on serverX to prevent root logins.

1. As user root, edit /etc/ssh/sshd_config on serverX so that "PermitRootLogin" is uncommented and set to "no."

   PermitRootLogin no

2. Restart the SSH service on the serverX machine.

   [root@serverX ~]# systemctl reload sshd

3. Confirm that root cannot log in with SSH, but student is permitted to log in.

   [student@desktopX ~]$ ssh root@serverX
   Password: redhat
   Permission denied, please try again.
   Password: redhat
   Permission denied, please try again.
   Password: redhat
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)
   
   [student@desktopX ~]$ ssh student@serverX
   [student@serverX ~]$ 

Configure SSH on serverX to prevent password authentication.

1. Edit the configuration file /etc/ssh/sshd_config as user root so that the "PasswordAuthentication" entry is set to "no":

   PasswordAuthentication no

2. Restart the SSH service.

   [root@serverX ~]# systemctl reload sshd

3. Confirm that visitor cannot log in using a password, but student is permitted to log in using the SSH keys created earlier.

   [student@desktopX ~]$ ssh visitor@serverX
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
   [student@desktopX ~]$ ssh student@serverX
   [student@serverX ~]$