3

I want to build a CentOS7 server by myself.

Now I already followed the steps mentioned in this link: https://www.digitalocean.com/community/tutorials/initial-server-setup-with-centos-7, which includes

  1. generated my new key .pub file using keygen.
  2. add its content start with "ssh-rsa" to .ssh/authorized_keys
  3. chmod the key and the .ssh folder,
  4. configure sshd using vi /etc/ssh/sshd_config
  5. use systemctl reload sshd to restart sshd.

At this point, I thought the future ssh operations from my client host should already need the key to do the log in. However, at this point I can still using ssh to log in my server with only password.

Are there any special procedure that I miss?

3

Open sshd configuration file and uncomment or add line PasswordAuthentication no. Restart sshd service.

2
  1. add its content start with "ssh-rsa" to .ssh/authorized_keys

No... This should go on the remote system. On your personal system you keep the private key, and you add the public key to all the /home/<user>/.ssh/authorized_keys of all systems/userids you want to access using the key. This can be done 'manually' or using ssh-copy-id, typically:

ssh-copy-id -i ~/.ssh/your_key.pub remote-host

or

ssh-copy-id -i ~/.ssh/your_key.pub user@remote-host

if this is a different userid.

If you do it manually, make sure that you keep the correct authorization flags on all files and .ssh directories (should be R/W strictly for that user only, no access whatsoever by anyone else).

  • So how to let a new client (which does not have access to the server) access to the server? Is the ssh-copy-id still gonna work? – Charles Zha Aug 31 '17 at 13:54
  • And if I want to generate a key to be used by multiple host, should I use the public key(.pub) or no-public key? – Charles Zha Aug 31 '17 at 13:55
  • 1
    You copy the .pub to each of the hosts. And you keep the private key on your PC. – xenoid Aug 31 '17 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.