1
00:00:00,630 --> 00:00:01,920
In many distros on Linux,

2
00:00:01,920 --> 00:00:03,480
the default authentication method

3
00:00:03,480 --> 00:00:05,880
for SSH is the password.

4
00:00:05,880 --> 00:00:08,280
Now, today we know that's not secure.

5
00:00:08,280 --> 00:00:09,113
So what we're going to do

6
00:00:09,113 --> 00:00:11,913
is set up a public key authentication method.

7
00:00:12,780 --> 00:00:15,150
So first, we're going to generate our own public

8
00:00:15,150 --> 00:00:16,500
and private key pair.

9
00:00:16,500 --> 00:00:18,960
We're going to load the public key on the remote server

10
00:00:18,960 --> 00:00:21,060
that we want to have access to.

11
00:00:21,060 --> 00:00:22,950
And whenever we try to log into that system,

12
00:00:22,950 --> 00:00:24,900
it's going to challenge us.

13
00:00:24,900 --> 00:00:26,910
And the response is only going to be able

14
00:00:26,910 --> 00:00:29,220
to be know by someone who has a private key,

15
00:00:29,220 --> 00:00:30,840
which will be on our server.

16
00:00:30,840 --> 00:00:32,783
So let's go ahead and generate that key pair.

17
00:00:35,640 --> 00:00:36,473
Okay.

18
00:00:36,473 --> 00:00:38,450
We're going to accept the default location.

19
00:00:41,700 --> 00:00:42,633
Create a password.

20
00:00:44,970 --> 00:00:45,803
All right.

21
00:00:47,490 --> 00:00:50,090
All right, so let's just view our private key first.

22
00:00:51,239 --> 00:00:52,589
It'll be in the ssh folder.

23
00:00:57,413 --> 00:00:58,246
Okay.

24
00:00:58,246 --> 00:01:01,740
Now we see that is a long screen of characters

25
00:01:01,740 --> 00:01:04,019
and it's going to be nearly impossible to be guessed,

26
00:01:04,019 --> 00:01:06,870
so that's what increases the security

27
00:01:06,870 --> 00:01:10,290
of using the RSA and public key encryption.

28
00:01:10,290 --> 00:01:11,370
I'm going to do the same thing

29
00:01:11,370 --> 00:01:13,464
just as I would for a public key.

30
00:01:13,464 --> 00:01:14,543
It's going to be a little smaller.

31
00:01:16,230 --> 00:01:17,063
Okay.

32
00:01:17,063 --> 00:01:20,280
Now, remember, the public and private key fit together

33
00:01:20,280 --> 00:01:22,710
and those are the only two keys that will work.

34
00:01:22,710 --> 00:01:26,040
So anyone could encrypt something using your public key

35
00:01:26,040 --> 00:01:27,780
and only you can decrypt it,

36
00:01:27,780 --> 00:01:29,070
which are a private.

37
00:01:29,070 --> 00:01:30,960
So I won't use the same key

38
00:01:30,960 --> 00:01:33,480
to encrypt and decrypt messages,

39
00:01:33,480 --> 00:01:35,790
which is known as symmetric encryption.

40
00:01:35,790 --> 00:01:39,090
As mentioned earlier, we need to send our public key

41
00:01:39,090 --> 00:01:40,320
to the remote server.

42
00:01:40,320 --> 00:01:41,873
So let's go ahead and do that now.

43
00:01:49,650 --> 00:01:50,700
I can click yes there.

44
00:01:50,700 --> 00:01:54,000
Now, I created an account on the remote server

45
00:01:54,000 --> 00:01:57,060
just for SSH connections from our server.

46
00:01:57,060 --> 00:02:00,240
So server01ssh is the account

47
00:02:00,240 --> 00:02:02,283
that's local to server02.

48
00:02:09,660 --> 00:02:12,840
Okay, it looks like we successfully uploaded our public key.

49
00:02:12,840 --> 00:02:14,811
Let's go ahead and try to log in.

50
00:02:14,811 --> 00:02:19,173
I'm going to do ssh server01ssh@server02.

51
00:02:27,090 --> 00:02:29,340
All right, now we're going to save this

52
00:02:29,340 --> 00:02:31,533
'cause this going to unlock our private key.

53
00:02:35,310 --> 00:02:37,920
Okay, it looks it went through successfully.

54
00:02:37,920 --> 00:02:39,780
So now if you look at the prompt,

55
00:02:39,780 --> 00:02:43,710
you'll see server01ssh@server02.

56
00:02:43,710 --> 00:02:47,490
So I am now remotely connected to my partner's server.

57
00:02:47,490 --> 00:02:49,830
Now we're going to look at a file location in here.

58
00:02:49,830 --> 00:02:51,783
It's going to be under the ssh folder.

59
00:02:54,030 --> 00:02:56,780
'Kay, once we list this out, we'll see authorized_keys.

60
00:02:59,580 --> 00:03:02,040
And this is going to be the stored location

61
00:03:02,040 --> 00:03:05,070
of the public key that I just uploaded.

62
00:03:05,070 --> 00:03:07,560
So now the server knows whenever I'm trying

63
00:03:07,560 --> 00:03:09,540
to authenticate from my server,

64
00:03:09,540 --> 00:03:11,280
so I'm going to use this public key

65
00:03:11,280 --> 00:03:12,680
to challenge my private key.

66
00:03:14,400 --> 00:03:17,370
Okay, now that was easy enough.

67
00:03:17,370 --> 00:03:19,642
Now, what we're going to do for a little added security

68
00:03:19,642 --> 00:03:22,950
is we need to modify our file

69
00:03:22,950 --> 00:03:25,890
to allow us to disable the password

70
00:03:25,890 --> 00:03:27,690
because remember that it's one

71
00:03:27,690 --> 00:03:30,150
of the weakest types of authentication.

72
00:03:30,150 --> 00:03:32,650
I'm going to switch to the root user on their server.

73
00:03:33,679 --> 00:03:38,679
And I'm going to edit the /etc/ssh/sshd_config file, okay?

74
00:03:43,530 --> 00:03:44,640
Now, previously, I searched through,

75
00:03:44,640 --> 00:03:46,740
just looked for password authentication.

76
00:03:46,740 --> 00:03:49,140
So again, to do that you're going to use the forward slash.

77
00:03:49,140 --> 00:03:50,163
Just type that in.

78
00:03:52,500 --> 00:03:54,840
And that's how I was able to find that quickly.

79
00:03:54,840 --> 00:03:55,673
Okay.

80
00:03:55,673 --> 00:03:59,397
So I'm going to go up here, down a little bit.

81
00:04:03,480 --> 00:04:06,150
I want to edit this PasswordAuthentication.

82
00:04:07,740 --> 00:04:08,940
Let's change this to no.

83
00:04:12,028 --> 00:04:12,861
Okay.

84
00:04:14,696 --> 00:04:16,500
Okay, I'm going to write quit that.

85
00:04:16,500 --> 00:04:17,487
Okay, last thing we need to do,

86
00:04:17,487 --> 00:04:19,620
add that configuration change

87
00:04:19,620 --> 00:04:22,743
is we start the SSH.

88
00:04:25,590 --> 00:04:26,880
Okay?

89
00:04:26,880 --> 00:04:27,780
Now, to test it out,

90
00:04:27,780 --> 00:04:30,210
we're going to log into account on there,

91
00:04:30,210 --> 00:04:32,940
which is johnsnow is one of the accounts.

92
00:04:32,940 --> 00:04:34,790
And we're going to see what it tells us.

93
00:04:46,350 --> 00:04:47,820
We should get denied

94
00:04:47,820 --> 00:04:50,670
because we don't have the private key

95
00:04:50,670 --> 00:04:54,090
for the account stored on our side,

96
00:04:54,090 --> 00:04:57,510
and also there's no way to authenticate using a password

97
00:04:57,510 --> 00:04:59,100
because we have disabled it.

98
00:04:59,100 --> 00:05:01,290
So again, typically, if we had a password

99
00:05:01,290 --> 00:05:03,630
for remote connections, we can just type that in

100
00:05:03,630 --> 00:05:05,730
but since we don't have the private key,

101
00:05:05,730 --> 00:05:08,580
or the public key, we now have permission denied.

102
00:05:08,580 --> 00:05:10,350
Again, that's just another configuration

103
00:05:10,350 --> 00:05:13,233
that we'd like to make to keep things even more secure.

104
00:05:14,790 --> 00:05:17,370
Okay, we walked through how to securely connect

105
00:05:17,370 --> 00:05:21,150
to a remote server using public key encryption.

106
00:05:21,150 --> 00:05:23,640
We generated a public and private key pair,

107
00:05:23,640 --> 00:05:25,220
uplaoded a public key to the wrong server

108
00:05:25,220 --> 00:05:26,760
so we were able to access it

109
00:05:26,760 --> 00:05:28,890
using the public key infrastructure

110
00:05:28,890 --> 00:05:30,543
or also known as PKI.

111
00:05:31,410 --> 00:05:32,670
Thank you for sticking with this walkthrough

112
00:05:32,670 --> 00:05:34,470
and I'll see you in the next lesson.