Red Hat Security: Linux in Physical, Virtual, and Cloud

Configure serverb to allow SSH key-based authentication. Configuration is successful when the student user on servera can log in to serverb using SSH key-based authentication.

1. From workstation, log in to servera as the student user.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 
   

2. On servera as the student user, create an SSH key pair with no passphrase.

   [student@servera ~]$ ssh-keygen
   Generating public/private rsa key pair.
   Enter file in which to save the key (/home/student/.ssh/id_rsa): Enter
   Created directory '/home/student/.ssh'.
   Enter passphrase (empty for no passphrase): Enter
   Enter same passphrase again: Enter
   Your identification has been saved in /home/student/.ssh/id_rsa.
   Your public key has been saved in /home/student/.ssh/id_rsa.pub.
   The key fingerprint is:
   SHA256:8CttStESwlNmmGot+dXN9cR9x4Hw46gdRmVM5XFj+TQ student@servera.lab.example.com
   The key's randomart image is:
   +---[RSA 2048]----+
   |     o+    .+=oO+|
   |   .o+      =o=EX|
   |   ++ o. o o = o=|
   |  = .o.=. + o o .|
   | . o .o S  + .   |
   |    .  + .+ .    |
   |      o +. .     |
   |     . +         |
   |      .          |
   +----[SHA256]-----+
   [student@servera ~]$ 
   

3. On servera, copy the SSH public key to the student account on serverb.

   [student@servera ~]$ ssh-copy-id student@serverb
   /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/student/.ssh/id_rsa.pub"
   The authenticity of host 'serverb (172.25.250.11)' can't be established.
   ECDSA key fingerprint is SHA256:BMdnasLF5CBGg42Dx77nuXodXdI9dKoEBQGFK5O0HRI.
   ECDSA key fingerprint is MD5:9e:a8:ec:0c:86:d2:70:34:ef:5a:94:15:6d:48:73:db.
   Are you sure you want to continue connecting (yes/no)? yes
   /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
   /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
   student@serverb's password: student
   
   Number of key(s) added: 1
   
   Now try logging into the machine, with:   "ssh 'student@serverb'"
   and check to make sure that only the key(s) you wanted were added.
   
   [student@servera ~]$ 
   

4. On servera, test the ability to use key-based authentication by using the ssh command to connect to serverb and remotely execute the hostname command. No password is required. The results are returned to the terminal on servera.

   [student@servera ~]$ ssh serverb 'hostname'
   serverb.lab.example.com
   [student@servera ~]$ 
   

On serverb, modify the OpenSSH server configuration file to prohibit logging in by the root user.

1. Confirm that the current configuration on serverb allows root user to log in using ssh. On servera, log in to serverb as the root user.

   [student@servera ~]$ ssh root@serverb
   root@serverb's password: redhat       
   [root@serverb ~]# 
   

   Logout of serverb.

   [root@serverb ~]# logout
   [student@servera ~]$ 
   

2. On servera, log in to serverb as the student user.

   [student@servera ~]$ ssh student@serverb
   [student@serverb ~]$ 
   

3. Use the sudo -i command to change to the root user. If prompted, use student as the password.

   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 
   

4. As the root user, edit /etc/ssh/sshd_config on serverb so that PermitRootLogin is set to no and uncommented. When finished, save your changes and exit the text editor.

   [root@serverb ~]# vim /etc/ssh/sshd_config
   ...output omitted...
   PermitRootLogin no
   ...output omitted...
   

5. Reload the SSH service on serverb. When finished, log out from serverb.

   [root@serverb ~]# systemctl reload sshd
   [root@serverb ~]# logout
   [student@serverb ~]$ logout
   Connection to serverb closed.
   [student@servera ~]$ 
   

6. On servera, use SSH to confirm that the root user is not permitted to log in to serverb, but the student user is permitted to log in. When finished, log out from serverb.

   [student@servera ~]$ ssh root@serverb
   Password: redhat
   Permission denied, please try again.
   Password: redhat
   Permission denied, please try again.
   Password: redhat
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)
   [student@servera ~]$ ssh student@serverb
   ...output omitted...
   [student@serverb ~]$ logout
   Connection to serverb closed.
   [student@servera ~]$ 
   

Configure SSH on serverb to prevent password authentication.

1. Confirm that the current configuration on serverb allows users to log in using ssh password authentication. On servera, log in to serverb as the visitor user.

   [student@servera ~]$ ssh visitor@serverb
   visitor@serverb's password: redhat       
   visitor@serverb ~]$ 
   

   Logout of serverb.

   [visitor@serverb ~]$ logout
   [student@servera ~]$ 
   

2. From servera, log in to serverb as the student user.

   [student@servera ~]$ ssh student@serverb
   ...output omitted...
   [student@serverb ~]$ 
   

3. As the student user on serverb use the sudo -i command to change to the root user. If prompted, use student as the password.

   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 
   

4. As the root user, edit the configuration file /etc/ssh/sshd_config so that the PasswordAuthentication entry is set to no. When finished, save your changes and exit the text editor.

   [root@serverb ~]# vim /etc/ssh/sshd_config
   ...output omitted...
   PasswordAuthentication no
   ...output omitted...
   

5. Reload the SSH service on serverb. When finished, log out from serverb.

   [root@serverb ~]# systemctl reload sshd
   [root@serverb ~]# logout
   [student@serverb ~]$ logout
   Connection to serverb closed.
   [student@servera ~]$ 
   

6. On servera, verify that the visitor user cannot log in to serverb. Then, verify that the student user can log in using the SSH keys created earlier.

   [student@servera ~]$ ssh visitor@serverb
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
   [student@servera ~]$ ssh student@serverb
   ...output omitted...
   [student@serverb ~]$ 
   

7. Log out from serverb and servera.

   [student@serverb ~]$ logout
   Connection to serverb closed.
   [student@servera ~]$ logout
   Connection to servera closed.
   [student@workstation ~]$