1

I have a cloud based server. I followed this guide to configure its security : http://www.rubytreesoftware.com/resources/securely-setup-ubuntu-1404-server

The configuration of SSH is as follows:

# Edit or add the following configuration to sshd_config
PermitRootLogin no
PasswordAuthentication no
X11Forwarding no
AllowUsers andy deploy

I authenticate with the remote server by adding my private key on my laptop to the authorised keys on the host.

My concern is, what happens if I loose my public key on the laptop. Am I locked out the server? What is best practice here - and how can I mitigate the risk of loosing my public key?

What happens if my public key changes? Also can I 'backup' my public key incase this happens? I assume no because its a key pair specific to the machine but worthwhile checking.

The firewall being used is ufw and is configured like so :

# configure ufw
sudo ufw logging on
sudo ufw allow ssh
sudo ufw allow www

If there is something else I should have done to secure this server which delivers a web application please let me know what I've missed. Any good articles on securing servers which are cloud based and serve public applications would be highly appreciated.

Improve this question
2

What happens if I loose my public key on the laptop. Am I locked out the server?

If you don't have backups yes you'll be locked out, at least temporarily until you can restore your access.

Some VPS providers have a method for replacing keys on server instances. Some provide console access. On others you'd have to spin up a second, temporary server and give it access to the first server's storage to manually fix the access.

What is best practice here - and how can I mitigate the risk of loosing my public key?

Securely back up your private key.

What happens if my public key changes?

Why would your public key change? If you have a backup of your private key this wouldn't be a concern.

Also can I 'backup' my public key incase this happens? I assume no because its a key pair specific to the machine but worthwhile checking.

Yes, you can back it up. No, it is not tied to a specific machine. You can load your private key up on any system to use it (assuming that system has the necessary software to utilise said key).

If there is something else I should have done to secure this server which delivers a web application please let me know what I've missed.

At this point your question is becoming too broad. I suggest doing a search for common server hardening principles. You'll find things like setting up a VPN, restricting administrative access based on source IP (Firewall changes), and using software like DenyHosts or fail2ban.

Improve this answer
  • If i backup my private key, but loose my public key - doesn't that render the private key useless. I will need my public key on all machines I want to connect to the server on won't I? This means if i take my public key with me, I can use it on any pc easily without having to reconfigure my server? – RenegadeAndy Aug 21 '15 at 9:21
  • 1
    If you lose the public key it can be regenerated from the private key. – Gene Aug 21 '15 at 9:25
  • The public key goes onto the remote server you are connecting to. The private key resides on the system you are connection from. If you want to connect to the same server from multiple workstations you will either need to copy the private key from one work station to the other (not recommended) or generate a key pair on the second work station and add its public key to the remote server. OpenSSH will allow you to define as many authorized keys as you need. – Gene Aug 21 '15 at 9:28
  • Do private keys ever 'expire'? – RenegadeAndy Aug 21 '15 at 9:31
  • 1
    No, private keys do not expire. – Gene Aug 21 '15 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.