Business Internet and Telephony, since 1985

Throwing Away Your Password to Enable Secure Logins on Remote Hosts.

Printer-friendly versionPrinter-friendly versionSend to friendSend to friend Share this

Following below is a Talk Back discussion on the Story entitled: Throwing Away Your Password to Enable Secure Logins on Remote Hosts.

Here's a snippet of the article to refresh your memory, or you can just select the link above to view the item in its entirety:

"We thought we would clarify the process by which someone creates a SSH key pair in order to securely connect to one or more remote hosts.

This method alleviates and obviates the need for you to login using your password in combination with your username on a remote host, but more importantly, it secures that connection because afterward, you should disable the ability to login with a password for the given account...
"

Below is the discussion so far. Feel free to add your own comments!

Comments

What about Ubuntu?

This is one of the best tutorials I have ever read on how to do passwordless logins with encryption in ssh.

The only snag in this tutorial is that I use Ubuntu and the author said it sucks to be me. Maybe, but that is what I use and I want to do this for Ubuntu.

Can I do this for Ubuntu? Or do I have to do something completely different? Are there just a few things I need to do different or do I hae to run slackware to make this work?

I have vps system at rackspace and I have been broken into three times. Each one made me install from the beginning again and I think this would make things a lot harder for the hackers to take control of my vps.

Thank you again for such a clear and step by step example.

Jake Kosmey

I'll try to give you an assist...

Hi Jake.

We don't typically recommend Ubuntu, although we're often forced to support it since it is indeed a popular distribution, and anytime someone comes over from the Dark Side, it's generally a good thing.

Let me see if I can address your points in order.

Yes, it sucks to be you because you're running Ubuntu. Sorry if that offends, but I'm entitled to my own set of bigoted prejudices too :) Seriously, you don't suck, you just need a little more time to come around is all ;)

There are a lot of Linux distros, and other flavors of UNIX in this world, and most are pretty good. Even the one's that I don't think are all that great can usually be whipped into shape to do what you need them to.

So let's make Ubuntu work for you in this regard. Shall we?

Okay, for starters, Ubuntu is based to a large degree upon the debian GNU/Linux Distribution, which is an excellent platform. you're not going to find your init scripts in /etc/rc.d, however, as they're located in /etc/init.d - so here's the command to restart the SSH daemon on your machine.

joeuser@remotebox:~$ sudo /etc/init.d/ssh restart

Note that the $ sign in your prompt indicates that you are an unprivileged user and you are issuing the restart command to the daemon's init script via the 'sudu' command.

In your sshd_conf file, many of the defaults are not commented out. This isn't a problem, yet where I indicate in the tutorial to remove the comments from the default settings, you might see that you don't need to do that.

Also, your X11Forwarding and UsePAM directives are probably also set to yes - I'll leave that to you to determine what is best for you in that regard.

Other than subtle differences in your sshd_config file which you need to take into acount and the fact that your init scripts are in /etc/init.d, most of the tutorial's content should serve you well. Read the man pages. man is your friend :)

joeuser@remotebox:~$ man sshd_config

I can't possibly address much more, since you stated that you're running Ubuntu on a VPS. The amount and various software included in an OpenVZ template (which is what you're running if you have a rackspace "Cloud Server") are as varied as the people who create them.

Since it's rackspace, however, I would imagine your VPS came with very little (They leave the choices of most software up to you to install), so you may need to install some OpenSSH stuff. The following commands won't hurt if you already have that stuff on your remote host:

joeuser@remotebox:~$ sudu apt-get install openssh-client
joeuser@remotebox:~$ sudu apt-get install openssh-client

Again, man is your friend - use it. In particular, you should man apt, apt-get, sources.list, apt-cache, apt-conf, aptitude, and dpkg. That will get you off to a good start.

Getting back to not being able to ascertain exactly what a stock Ubuntu machine (and I don't even know if you're running Ubuntu Server, or just Ubuntu as a server) on a VPS is going to include as far as software, I wouldn't be able to say for sure even if you were running Slackware, Arch, or CentOS either - for the same reasons (without actually taking a look).

And that's why people hire us :)

But Jake, I must tell you that your problems run much deeper than securing your remote login sessions. There's a reason you're getting rooted, and you need to address that first, with firewalling (and configuring SSHD), noting what services and ports you have open, if those are secured, how many and the policies regarding your users, etc.

Besides, rackspace is actually a competitor of ours, and although we have a few OpenVZ VPS (Or Cloud Servers, as people are preferring to call them now) customers, we generally prefer to provide our customers with virtualization technologies based on vmware.

Again, that's why people hire us, and I'll be happy to consult with you on the matter if you wish, offlist. For the purposes of this thread though, I'd say we're about finished here, and I wish you all the best.

Kindest regards,

__________________

Bradley D. Thornton

Manager Network Services
NorthTech Computer
http://NorthTech.US
http://Linboard.org
TEL: +1.760.666.2703 (US)
TEL: +44.203.318.2755 (UK)

Registered Linux User #190795

"This is never going to work. You have to shut it down. Shut it down. Take the whole thing down." - James Allchin.