View source for SSH/Public Key Authentication

<syntaxhighlight lang="bash">
#################### CLIENT SIDE ####################
# generating a new ssh key and adding it to the ssh client
# https://gist.github.com/shahedhossain/7d91028ba1eb9c56049ea421a12e76fd

# ssh key generation for chorke
ssh-keygen -t rsa -b 4096 -C "user@rpi.chorke.org"
# Generating public/private rsa key pair.
# Enter a file in which to save the key (/Users/user/.ssh/id_rsa): [Press enter]
# Enter passphrase (empty for no passphrase): [Type a passphrase]
# Enter same passphrase again: [Type passphrase again]

# rpi_chorke_rsa add to ~/.ssh/config
Host rpi.chorke.org
     HostName 139.59.51.80
     # PreferredAuthentications publickey
     IdentityFile ~/.ssh/rpi_chorke_rsa
     Port 4321

# copy root/misc public key to ~/.ssh/authorized_keys for each users
ssh-copy-id -i ~/.ssh/rpi_chorke_rsa.pub root@139.59.51.80 -p 4321
ssh-copy-id -i ~/.ssh/rpi_chorke_rsa.pub misc@139.59.51.80 -p 4321
</syntaxhighlight>

<syntaxhighlight lang="bash">
#################### SERVER SIDE ####################
# for disable password authentication
# & enable public key authentication
# edit by /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

# after edit save & exit restart sshd
# to update sshd configuration
# systemctl restart sshd
service sshd restart
</syntaxhighlight>

<syntaxhighlight lang="bash">
#################### CLIENT SIDE ####################
# root user public key
ssh root@rpi.chorke.org
# Enter passphrase for key '/Users/user/.ssh/rpi_chorke_rsa':

# misc user public key
ssh misc@rpi.chorke.org
# Enter passphrase for key '/Users/user/.ssh/rpi_chorke_rsa':
</syntaxhighlight>

<syntaxhighlight lang="bash">
#################### CLIENT SIDE ####################
# root user password disabled
ssh root@139.59.51.80 -p 4321
# root@139.59.51.80: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

# misc user password disabled
ssh misc@139.59.51.80 -p 4321
# user@139.59.51.80: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
</syntaxhighlight>

==EdDSA==
 ssh-keygen -t ed25519 -C "user@rpi.chorke.org"
 ssh-keygen -t ed25519 -C "user@rpi.chorke.org" -f ~/.ssh/id_ed25519

 chmod 600 ~/.ssh/id_ed25519
 chmod 644 ~/.ssh/id_ed25519.pub

==Too Many Auth==
{|
|valign="top"|
 '''too many authentication failures issue'''
 ssh -o PreferredAuthentications=password ${USER}@academia.local
 ssh -o IdentityAgent=none ${USER}@academia.local
 ssh -o IdentitiesOnly=yes ${USER}@academia.local

|valign="top"|
 Host *.local
      IdentityAgent none
      IdentitiesOnly yes
      PreferredAuthentications password

|valign="top"|
 Host 10.19.83.*
      IdentityAgent none
      IdentitiesOnly yes
      PreferredAuthentications password

|}

== References==
* [https://serverfault.com/questions/1159599/ SSH server » Ubuntu » Change the default port]
* [https://gist.github.com/shahedhossain/73adbb5d812786875705a26c0c174928 Fedora SSH Client Public Key Authentication]
* [https://goteleport.com/blog/comparing-ssh-keys/ SSH Keys » RSA, DSA, ECDSA vs EdDSA]
* [https://www.raspberrypi.org/documentation/remote-access/ssh/passwordless.md Raspberry Pi Public Key Authentication]
* [[Bastion SSH Tunneling]]