Comment utiliser les clés SSH pour l’authentification d’accès à distance ?

SSH, or Secure Shell, is a protocol used to securely log onto remote systems. It is the most common way to access remote Linux servers. An SSH key pair eliminates manual password authentication, creating a faster server login process and enhanced remote server access security.

1. Generate SSH Key Pair: On your local machine, generate an SSH key pair using the following command: ssh-keygen -t rsa -b 2048 2. Copy Public Key to Remote Server: Use the following command to copy your public key to the remote server: ssh-copy-id user@hostname 3. Test SSH Connection: Verify that you can now connect to the remote server without using a password: ssh user@hostname 4. Optional: Disable Password Authentication: Edit the SSH server configuration file (usually located at /etc/ssh/sshd_config) and set: PasswordAuthentication no. Restart the SSH service for changes to take effect.

SSH keys are a pair of cryptographic keys used to authenticate secure connections over the SSH (Secure Shell) protocol. They consist of a public key and a private key: 1. **Public Key**: This key can be shared with anyone and is typically stored on the server you want to connect to. It allows the server to recognize you as an authorized user. 2. **Private Key**: This key is kept secret and is stored securely on your device. It should never be shared. When you attempt to connect to a server, your client uses the private key to prove your identity to the server. SSH keys are more secure than passwords, as they are resistant to brute-force attacks. - **Convenience**: Once set up, they allow for passwordless logins, simplifying access.

There are two commonly used algorithms for generating authentication keys: RSA – an SSH RSA key is considered highly secure as it has typically larger key sizes, often 2048 or 4096 bits. It is also more compatible with older operating systems. Ed25519 – a more modern algorithm with a smaller standard key size of 256 bits. It is just as secure and efficient as an RSA key due to its strong cryptographic properties. The compatibility is lower, but newer operating systems support it. First, open your Terminal or local SSH client. Then, enter the ssh-keygen command: ssh-keygen -t ed25519 The SSH command will display the following message: Generating public/private ed25519 key pair. 🙏🙏

Best ways to manage SSH keys; Launch your Terminal or SSH client. Then, enter the following command to start the SSH agent: eval "$(ssh-agent -s)" Use the ssh-add command to add your private key to the SSH agent. Replace ‘private_key’ with your file name. ssh-add ‘private_key’ If your private key is protected with a passphrase, it will prompt you to enter it. Run the following command to confirm that your private key has been added. It will list the identities currently held by the agent. ssh-add -l With the SSH agent running and your private key added, you can connect to remote servers without entering your passphrase for each session. Simply use the ssh username@remote_server command to log in.

Normalmente usamos SSH para autenticarnos con privilegios en los sistemas. Es importante incorporar en nuestra organización una gestión del acceso con privilegios (PAM) para estar protegido de las amenazas que pueden poner en peligro nuestras credenciales y además controlar el uso indebido de privilegios en los sistemas. El uso de una estrategia PAM, comprende procesos, personas y tecnología con el fin de proteger y auditar todas las identidades y actividades con privilegios en el entorno informático de una empresa.

Authentication with SSH keys can be a little more complex, but helps increase security when logging into an SFTP server. Here’s the quick and dirty on how SSH keys work for authentication: An SSH key pair, which includes a public and private cryptographic key, is generated by a computer. The public key is stored on the server that you log into, while the private key is stored on your computer.

Le véritable avantage de la clé SSH va au delà de l'absence de mot de passe. Il est en effet possible de chiffrer une clé SSH avec un mot de passe pour plus de sécurité (il faudra rentrer le mot de passe pour utiliser la clé). Le véritable avantage est de ne pas avoir à partager de secret entre le serveur et le client. Le serveur a seulement besoin de savoir quelle clé publique il autorise, à aucun moment la clé privée ne transite vers le serveur. Si le serveur est corrompu, il ne pourra pas récupérer la clé privée et donc il ne pourra pas l'utiliser pour une autre authentification. Avec un mot de passe, même stocké en tant que hash, il faudra l'envoyer au serveur lors de l'authentification et le serveur pourrait l'intercepter.