{"id":145,"date":"2017-04-05T21:00:03","date_gmt":"2017-04-06T00:00:03","guid":{"rendered":"https:\/\/www.linuxpro.com.br\/2017\/04\/ssh-sem-senha\/"},"modified":"2026-09-08T02:31:58","modified_gmt":"2026-09-08T05:31:58","slug":"ssh-sem-senha","status":"publish","type":"post","link":"https:\/\/www.linuxpro.com.br\/en\/2017\/04\/ssh-sem-senha\/","title":{"rendered":"Using SSH authentication keys"},"content":{"rendered":"

\"Mascote<\/p>\n

Note (2026):<\/strong> The 2017 how-to generated RSA (ssh-keygen -t rsa<\/code>) and disabled passwords with UsePAM no<\/code> + \/etc\/init.d\/ssh restart<\/code>. Today the default is Ed25519<\/strong>; PAM stays enabled; the drop-in goes in sshd_config.d<\/code>; only disable passwords after testing the key in a second session.<\/div>\n

SSH passwords still fall to brute-force attacks. The key pair \u2014 public on the server, private on your machine, protected by a passphrase \u2014 is the 2026 login method. OpenSSH on Ubuntu 24.04\/26.04 already generates Ed25519 if you call ssh-keygen<\/code> without flags (since 9.5). The rest is permissions, ssh-copy-id<\/code> and not locking yourself out.<\/p>\n

<\/p>\n

Generate the key on the client<\/h2>\n

As your user, never as root:<\/p>\n

ssh-keygen -t ed25519 -a 64 -C \"$(whoami)@$(hostname)-2026\"\n<\/code><\/pre>\n
Accept ~\/.ssh\/id_ed25519<\/code>. Use a real passphrase \u2014 a private key without one is a login stored in a file. -a 64<\/code> increases KDF rounds. An old server that does not support Ed25519 (rare): ssh-keygen -t rsa -b 4096<\/code>. DSA is dead in OpenSSH 7+.<\/p>\n
chmod 700 ~\/.ssh\nchmod 600 ~\/.ssh\/id_ed25519\nchmod 644 ~\/.ssh\/id_ed25519.pub\n<\/code><\/pre>\n
Install the public key on the server<\/h2>\n
ssh-copy-id<\/code> creates ~\/.ssh<\/code>, fixes permissions, and appends the line to authorized_keys<\/code>:<\/p>\n
ssh-copy-id -i ~\/.ssh\/id_ed25519.pub usuario@servidor\n# porta n\u00e3o padr\u00e3o:\nssh-copy-id -i ~\/.ssh\/id_ed25519.pub -p 2222 usuario@servidor\n<\/code><\/pre>\n
Without ssh-copy-id<\/code>:<\/p>\n
ssh usuario@servidor 'mkdir -p ~\/.ssh && chmod 700 ~\/.ssh'\ncat ~\/.ssh\/id_ed25519.pub | ssh usuario@servidor 'cat >> ~\/.ssh\/authorized_keys && chmod 600 ~\/.ssh\/authorized_keys'\n<\/code><\/pre>\n
Test it before<\/strong> changing sshd<\/code>:<\/p>\n
ssh -i ~\/.ssh\/id_ed25519 -o IdentitiesOnly=yes usuario@servidor\n<\/code><\/pre>\n
You must get in without the account password (the agent asks for the key's passphrase, if any). Leave this session open. Open another terminal for hardening.<\/p>\n
Disable passwords \u2014 without UsePAM no<\/h2>\n
On Ubuntu, UsePAM no<\/code> (the 2017 advice) breaks other PAM paths. Keep PAM. Use a drop-in, do not edit the entire sshd_config<\/code> :<\/p>\n
sudo tee \/etc\/ssh\/sshd_config.d\/99-keys-only.conf <<'EOF'\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPubkeyAuthentication yes\nPermitRootLogin prohibit-password\nEOF\nsudo sshd -t && sudo systemctl reload ssh\n<\/code><\/pre>\n
On RHEL\/Rocky the service is sshd<\/code>: sudo systemctl reload sshd<\/code>. Confirm in the session you left open, and in a new one<\/em>:<\/p>\n
ssh usuario@servidor\n<\/code><\/pre>\n
If the new one fails, the old session can still save you. Do not close the console until the key works twice.<\/p>\n
Agent, config, hardware key<\/h2>\n
ssh-agent<\/code> (or gnome-keyring) keeps the private key unlocked in the graphical session:<\/p>\n
eval \"$(ssh-agent -s)\"\nssh-add ~\/.ssh\/id_ed25519\n<\/code><\/pre>\n
A ~\/.ssh\/config<\/code> avoids a flag:<\/p>\n
Host lab\n  HostName 192.0.2.10\n  User nilton\n  IdentityFile ~\/.ssh\/id_ed25519\n  IdentitiesOnly yes\n<\/code><\/pre>\n
YubiKey \/ FIDO2: ssh-keygen -t ed25519-sk<\/code> (OpenSSH 8.2+). The private key never leaves the token. ssh-copy-id -i ~\/.ssh\/id_ed25519_sk.pub usuario@servidor<\/code>.<\/p>\n
Wrap-up<\/h2>\n
Ed25519, ssh-copy-id<\/code>, test, and only then disable passwords. The 2017 diagram (client, session, keys) remains valid; the algorithm and the init.d<\/code> do not. Man page: man ssh-keygen<\/code>, man sshd_config<\/code>.<\/p>","protected":false},"excerpt":{"rendered":"
SSH passwords are still vulnerable to brute force. A key pair \u2014 the public key on the server, the private key on your machine, protected by a passphrase \u2014 is how you log in in 2026. OpenSSH on Ubuntu 24.04\/26.04 already generates Ed25519 when you run ssh-keygen \u2026 Read more<\/a><\/p>","protected":false},"author":0,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[14,4],"class_list":["post-145","post","type-post","status-publish","format-standard","hentry","category-linux","tag-howto","tag-linux"],"_links":{"self":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/comments?post=145"}],"version-history":[{"count":4,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/145\/revisions"}],"predecessor-version":[{"id":1077,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/145\/revisions\/1077"}],"wp:attachment":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/media?parent=145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/categories?post=145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/tags?post=145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}