In many distros on Linux,
the default authentication method
for SSH is the password.
Now, today we know that's not secure.
So what we're going to do
is set up a public key authentication method.
So first, we're going to generate our own public
and private key pair.
We're going to load the public key on the remote server
that we want to have access to.
And whenever we try to log into that system,
it's going to challenge us.
And the response is only going to be able
to be know by someone who has a private key,
which will be on our server.
So let's go ahead and generate that key pair.
Okay.
We're going to accept the default location.
Create a password.
All right.
All right, so let's just view our private key first.
It'll be in the ssh folder.
Okay.
Now we see that is a long screen of characters
and it's going to be nearly impossible to be guessed,
so that's what increases the security
of using the RSA and public key encryption.
I'm going to do the same thing
just as I would for a public key.
It's going to be a little smaller.
Okay.
Now, remember, the public and private key fit together
and those are the only two keys that will work.
So anyone could encrypt something using your public key
and only you can decrypt it,
which are a private.
So I won't use the same key
to encrypt and decrypt messages,
which is known as symmetric encryption.
As mentioned earlier, we need to send our public key
to the remote server.
So let's go ahead and do that now.
I can click yes there.
Now, I created an account on the remote server
just for SSH connections from our server.
So server01ssh is the account
that's local to server02.
Okay, it looks like we successfully uploaded our public key.
Let's go ahead and try to log in.
I'm going to do ssh server01ssh@server02.
All right, now we're going to save this
'cause this going to unlock our private key.
Okay, it looks it went through successfully.
So now if you look at the prompt,
you'll see server01ssh@server02.
So I am now remotely connected to my partner's server.
Now we're going to look at a file location in here.
It's going to be under the ssh folder.
'Kay, once we list this out, we'll see authorized_keys.
And this is going to be the stored location
of the public key that I just uploaded.
So now the server knows whenever I'm trying
to authenticate from my server,
so I'm going to use this public key
to challenge my private key.
Okay, now that was easy enough.
Now, what we're going to do for a little added security
is we need to modify our file
to allow us to disable the password
because remember that it's one
of the weakest types of authentication.
I'm going to switch to the root user on their server.
And I'm going to edit the /etc/ssh/sshd_config file, okay?
Now, previously, I searched through,
just looked for password authentication.
So again, to do that you're going to use the forward slash.
Just type that in.
And that's how I was able to find that quickly.
Okay.
So I'm going to go up here, down a little bit.
I want to edit this PasswordAuthentication.
Let's change this to no.
Okay.
Okay, I'm going to write quit that.
Okay, last thing we need to do,
add that configuration change
is we start the SSH.
Okay?
Now, to test it out,
we're going to log into account on there,
which is johnsnow is one of the accounts.
And we're going to see what it tells us.
We should get denied
because we don't have the private key
for the account stored on our side,
and also there's no way to authenticate using a password
because we have disabled it.
So again, typically, if we had a password
for remote connections, we can just type that in
but since we don't have the private key,
or the public key, we now have permission denied.
Again, that's just another configuration
that we'd like to make to keep things even more secure.
Okay, we walked through how to securely connect
to a remote server using public key encryption.
We generated a public and private key pair,
uplaoded a public key to the wrong server
so we were able to access it
using the public key infrastructure
or also known as PKI.
Thank you for sticking with this walkthrough
and I'll see you in the next lesson.