After setting up the bare VPS, it is time to gain secure access to our Ubuntu Server running on the VPS through a secure shell connection (SSH).
From the standard RFC 4252 that defines SSH:
The Secure Shell Protocol (SSH) is a protocol for secure remote login and other secure network services over an insecure network.
Of course, the insecure network here is the internet.
We will setup SSH access in two phases:
- Setup basic SSH with the normal login credentials
- Secure access further with a key
But first, we have to switch on the VPS again:
Start the VPS
And then click on the ubuntu TestVPS button to start the TransIP console. Now Ubuntu boots and we are greeted with the login screen again. I usually check for updates after logging in by performing the commands:
$ sudo apt-get update $ sudo apt-get upgrade
SSH is already running since I selected it to be installed in the previous article. Before we go any further I would enable the firewall and close every port for now, by entering:
$ sudo ufw enable $ sudo ufw status
Status: active is what we are aiming at. When we are done with configuring SSH, we mustn’t forget to open the SSH port, otherwise no connection will be possible. We should be secure enough for now.
Setting up basic SSH
We want to get SSH access as quick as possible. Our first step is to go over the SSH server settings:
$ nano /etc/ssh/sshd_config
and we change the following:
PermitRootLogin yes => PermitRooLogin no
Then restart the ssh service:
$ sudo service ssh restart
Then, remember that we need to open the ssh port (22) on the firewall. We do this by issuing:
$ sudo ufw allow OpenSSH $ sudo ufw status
Connecting from Windows with PuTTY
When you normally work from a Windows PC, you will need PuTTY. PuTTY is always the second tool I install on any Windows machine (right after Notepad++, a free but extremely capable text editor). PuTTY may look a bit odd if you are not used to it, but once you get the hang of connecting to your VPS, you will never look back.
Retrieve your IP address by looking at the information page of the VPS provider, or by simply typing:
And searching for the line that starts with “inet addr:” in the eth0 section.
Then start PuTTY, fill in your IP address, enter a session name, save the session and the click Open:
The very first time you connect to an SSH server, you will get the following warning:
We trust our own server. Press yes and you are greeted with:
Login with your credentials and you are in. From this moment on we will only need the TransIP console in case we seriously screw up.
Connecting from another Linux machine
This is even easier. Open a console and type:
Setting up public key authentication
With SSH we login with a key instead of password. If you don’t have a key at all, you will not get in. No retries, nothing.
I am going to describe two ways to get where we want to be:
- Create the key pair on Windows and use PuTTY to connect to the VPS from Windows
- Create the key pair on Linux and use the Linux console to connect to the VPS
Setting up public key authentication from Windows
We need PuTTYgen, which comes with a PuTTY installation. Start PuTTYgen and Select SSH-2 RSA and a bit length of 2048 (the default is 1024)
Click generate and move your mouse as instructed:
Enter a comment, and a passphrase. The private key must be accessible to you only. If someone gains access to the private key, he can connect without any restrictions to the server. By adding a passphrase you setup one more speed bump: now the private key is only useful if you know the passphrase. Bottom line: do not leave it empty.
Now save the private to a file; we need it in a bit to setup profiles in PuTTY and WinSCP. The public key we need to transfer to the server now, with the PuTTYgen window still open.
On the console make sure to be in your home directory:
This shows /home/bart in my case. If not, type
and check again. Now:
$ mkdir .ssh $ nano .ssh/authorized_keys
Right-click in PuTTYgen on the upper key and select all. Right-click again and select Copy. Now paste this key in the authorized_keys file by right-clicking in Nano. Then press Ctrl-X to close Nano and type “y” to save the file.
Test access from Windows
We have to add our previously saved private key to the PuTTY configuration.
First select the PuTTY configuration and click Load.
Fill in the path to the private key.
Fill in the auto-login username:
Then save the configuration again.
Now, when you connect to the VPS you only need to fill in the passphrase for your private key.
So far, so good, but we’re not quite finished. See Finish the configuration
Setting up public key authentication from Linux
From Linux the process is very similar. We configure the public and private keys on the local machine and then transfer the public key to the VPS.
First the key generation. The command below stores the private key in the file id_rsa.testvps and the public key in the file id_rsa.testvps.pub. I did not choose the default file id_rsa because that one was already in use. The bit behind -C is the key comment. Like in the section before, I also use a passphrase to protect the private key.
Now we need to transfer the public key to the VPS machine. We use scp for this.
On the VPS we now find the public key in the home directory. I am going to add the contents to the .ssh/authorized_keys file.
Now we can try to connect from Linux again. Note that I use an extra command parameter, because my desktop contains multiple private keys. An article in the links discusses a way to make multiple private keys easier to use.
In my case on Linux Mint, a window popped up to ask me for my passphrase.
This approach also works, but do not forget to finish the configuration.
We can securely connect to the VPS now with public key authentication. With that we do not want the password authentication anymore. Disabling password authentication happens in the SSH server configuration.
sudo nano /etc/ssh/sshd_config
In this file change the line from
Restart the SSH server to read the configuration
If you now try to connect with a user that does not exist or without providing a private key you will get stopped at the door:
The log file /var/log/auth.log will no longer show invalid users trying to log in, it will just mention that a connection was closed with the explanation [preauth].
Now the VPS is secure to connect to via SSH, but the VPS itself doesn’t do anything interesting yet. I will describe some uses in next articles.
Changing a passphrase
Every once in a while you should change the passphrase on your private keys. After changing the passphrase nothing needs to be copied.
ssh-keygen -p -i ~/.ssh/id_rsa
Start PuTTYgen. Click Load and open the private key. Change both passphrase fields and click Save.
- ServerFault on DSA vs RSA keys
- Summary on DSA vs RSA
- Wikipedia on ssh-keygen
- PuTTY and PuTTYgen
- Using PuTTYGen to generate SSH private/public keys on Katsande
- Multiple SSH private keys by Karanbir Singh, link not available anymore
- Another good set of instructions at the University of Waterloo