86
votes
Add comment to existing SSH public key
Just start the line with a # sign, then the whole line will be treated as a comment
See the man page of authorized_keys
- 1,048
32
votes
Accepted
Why should I use Public-Key Authentication for SSH?
if someone hacks into my computer, he doesn't just get my computer, but my server too?
This is potentially true anyway with keyloggers: as soon as you log into your server from the compromised ...
- 1,730
20
votes
How to get a .pem file from ssh key pair?
Initially, when using ssh-keygen, I could generate a public key that was compatible with AWS EC2, but had issues with creating private keys that were compatible. The following creates both public and ...
15
votes
Disable the public key check for rpm installation
For legacy RPM Linux without yum use:
rpm -i --nosignature
- 660
15
votes
ssh how to allow a very limited user with no home to login with pubkey
diya has already explained that you could change to AuthorizedKeysCommand for retrieving the public key of a user.
However, it's probably easier for you to place the authorized_keys file somewhere ...
- 892
12
votes
Accepted
Can I use Public-Key-Pins with LetsEncrypt?
Some words of caution to begin with:
Know what you're doing, if you're planing to implement HPKP.
If you don't do it right, or "if bad things happen", which aren't under your control, you might ...
- 5,651
12
votes
How to export private key? (GnuPG)
Hint 1: gpg calls private keys 'secret' because PGP dates from before people settled on the names 'private' key for the half of an asymmetric pair held by (ideally) only one party versus 'secret' key ...
- 3,469
12
votes
Why should I use Public-Key Authentication for SSH?
If you are using good passwords, this can be secure enough. I usually limit the number of publicly accessible servers to the minimum and allow SSH from specific IP(s) whenever possible.
Also, you can ...
- 36.9k
12
votes
Why should I use Public-Key Authentication for SSH?
One way where public-key authorization is more secure is when the attacker manages to be man-in-the-middle (MitM) between your client computer and the server, and you don't notice the changing host ...
- 253
11
votes
Can I use Public-Key-Pins with LetsEncrypt?
Would echo everything that gf_ said.
However, to answer the question, yes you can.
By default Let's Encrypt recreates the key and the cert at renewal. This makes implementing HPKP difficult if you ...
- 4,656
11
votes
SSH Public Key Format
This is the complete, correct answer:
ssh-keygen -i -m PKCS8 -f public-key.pem
- 245
11
votes
ssh how to allow a very limited user with no home to login with pubkey
The alternative to a file with public keys is the openssh server directive AuthorizedKeysCommand which allows you to configure your sshd daemon to run a specific helper program to retrieve the public ...
- 1,849
8
votes
Accepted
Why won't my SSH keys forward properly?
If you want to forward connection to your authentication agent, you need to have the authentication agent running on your machine. You can check it using ssh-add -l. If it is not running, start it and ...
- 10.1k
7
votes
Accepted
Public Key Authentication not work on Windows 10 Professional
I finally solved the problem by commenting out the lines:
Match Group administrators
AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
Then I placed the authorized keys ...
- 111
5
votes
Debian. How can I securely get debian-archive-keyring, so that I can do an apt-get update? NO_PUBKEY
Debian - Apt-get : NO_PUBKEY / GPG error
In computers based on a Debian operating system that uses Linux kernel, error messages may come up like 'NO_PUBKEY'.This happens while using the Apt-Get ...
- 587
5
votes
ssh still accepts password authentication despite being configured for public-key only authentication (which works!)
This additional line works for me in /etc/ssh/sshd_config.
AuthenticationMethods publickey
- 51
5
votes
Can I use Public-Key-Pins with LetsEncrypt?
I just implemented this using the dehydrated client with dns01 validation. The dns01 hook is certzure because our DNS is hosted in Azure.
Edit: when I talk about private keys, obviously I always mean ...
- 908
5
votes
Public Key Authentication not work on Windows 10 Professional
Use this sequence of commands in PowerShell to correct permission of administrators_authorized_keys
$acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys
$acl.SetAccessRuleProtection($true, ...
- 171
4
votes
Accepted
What is the good practice for adding known keys/fingerprints to known_hosts
Having a public key, you can simply write the key into the known_hosts file and possibly re-hash, if you need to:
HOSTNAME=my.awesome.host
PORT=7999
PUBKEY="ssh-rsa AAAAB3NzaC1yc2EAAAAD...E"
...
- 10.1k
4
votes
Accepted
Permission denied (publickey) for my AWS EC2 instance from another computer
Change your file permission to 400 (chmod 400 dymmy.pem) . The message clearly says that the file permissions are too open.
- 56
4
votes
Force SSH public key authentication for specific users
Another possible answer, as @larsks, answer did not work for my version of ssh_d as my version seems to be using the documentation found here which states:
Only a subset of keywords may be used on ...
- 250
4
votes
Accepted
Is it possible to disable ssh password authentication for own user without root access?
Short answer: No.
Apparently, the solution is to modify /etc/ssh/sshd_config by adding a block like this:
Match user myuser
PasswordAuthentication no
This obviously requires root privilege.
The ...
- 36.9k
4
votes
How to use PAM to manage lockout policy for ssh public key authentication methods
The problem is that you're trying to enforce these policies inside of the auth stack.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth ...
- 33.1k
4
votes
How to tell SFTP which public key to use?
First the file for the 'private' key contains all parts of your key. Both the public and private parts. If delete the local copy of your public key you can simply re-create it from the file that ...
- 132k
4
votes
Accepted
For SSH access only, do I leave `#PubkeyAuthentication yes` commented out in sshd_config, or uncomment it?
man sshd_config will show you that yes is the default value for PubkeyAuthentication. So you can leave it commented out; it's the same as yes.
The stock sshd_config file also includes a comment at the ...
- 8,936
3
votes
Authentication Order with SSH
Adding to the other two answers already mentioning the PreferredAuthentications option, I'd like to add you don't need to edit any file to set this setting if you don't want. Rather, you can just set ...
- 235
3
votes
Verify authenticity of SSH host on Digital Ocean droplet (FreeBSD)
I know this is an old question, but I ran across this exact same problem today, and the OP's spot-on with the TOFU anti-security model, so here's what I used to avert the risk of MITM.
Normally, as ...
- 31
3
votes
Accepted
Correct configuration of the SSHD config file?
I am not sure, whether excluding all public key algorithms, except ed25519 is not being overzealous and it a good security strategy. Security StackExchange can certainly tell you more on the subject.
...
- 5,928
3
votes
authorized_keys has my key, but it's still refused
You were doing the right thing using ssh -vvv from the client, pair it with a sshd in debug mode, like this:
a second server instance:
# /usr/sbin/sshd -p 1234 -dddd
a dedicated client to connect:
$ ...
- 1,508
3
votes
Accepted
the theory of SSH public and Private key and its application in realworld machines
my question starts here I saw many, many websites for setting up SSH via a public key and private keys (including ssh.com, windows website, raspberry pi documentation(as my server)). But I didn't see ...
- 36.8k
Only top scored, non community-wiki answers of a minimum length are eligible