Configure OpenSSH authentication

Protect remote login sessions from eavesdropping by configuring SSH key-based and smart card authentication methods.

SSH and OpenSSH
Copy link

SSH (Secure Shell) is a program for remote machine login and command execution. The SSH protocol provides encrypted communication between two untrusted hosts over an insecure network. You can also forward X11 connections and arbitrary TCP/IP ports over the secure channel.

The SSH protocol reduces security threats when you use it for remote shell login or file copying. It prevents interception of communication between two systems. It also prevents impersonation of a particular host.

The SSH client and server use digital signatures to verify their identities. All communication between the client and server systems is encrypted.

A host key authenticates hosts in the SSH protocol. Host keys are cryptographic keys. They are generated automatically when OpenSSH starts for the first time or when the host boots for the first time.

OpenSSH is an implementation of the SSH protocol supported by Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. The OpenSSH suite consists of the following user-space tools:

  • ssh is a remote login program (SSH client).
  • sshd is an OpenSSH SSH daemon.
  • scp is a secure remote file copy program.
  • sftp is a secure file transfer program.
  • ssh-agent is an authentication agent for caching private keys.
  • ssh-add adds private key identities to ssh-agent.
  • ssh-keygen generates, manages, and converts authentication keys for ssh.
  • ssh-copy-id is a script that adds local public keys to the authorized_keys file on a remote SSH server.
  • ssh-keyscan gathers SSH public host keys.

For more information, use the man -k ssh command.

Note

In RHEL 9 and later, SFTP replaces SCP by default. SCP has security issues such as CVE-2020-15778.

You can force the use of the original SCP/RCP protocol if SFTP is unavailable or incompatible in your scenario. Use the scp command with the -O option.

The OpenSSH suite in RHEL supports only SSH version 2. It has an enhanced key-exchange algorithm. This algorithm is not vulnerable to exploits known in the older version 1.

Red Hat Enterprise Linux includes the openssh, openssh-server, and openssh-clients packages. These OpenSSH packages require the OpenSSL package openssl-libs. This package contains cryptographic libraries for securing data exchange.

OpenSSH is one of the core cryptographic subsystems of RHEL. It uses system-wide cryptographic policies. This ensures that weak cipher suites and cryptographic algorithms are disabled in the default configuration.

To modify the policy, you can:

  • Use the update-crypto-policies command to adjust the settings.
  • Manually opt out of the system-wide cryptographic policies.

The OpenSSH suite uses two sets of configuration files. One set is for client programs (ssh, scp, and sftp). Another set is for the server (the sshd daemon).

System-wide SSH configuration information is stored in the /etc/ssh/ directory. The /etc/ssh/ssh_config file contains the client configuration. The /etc/ssh/sshd_config file is the default OpenSSH server configuration file.

User-specific SSH configuration information is stored in ~/.ssh/. For a detailed list of OpenSSH configuration files, see the FILES section in the sshd(8) man page on your system.

Generate SSH key pairs
Copy link

Generate an SSH key pair on your local system and copy the public key to the OpenSSH server to enable password-free login. Each user who wants to create a key must run this procedure.

Before you begin
Copy link

  • You are logged in as a user who wants to connect to the OpenSSH server by using keys.
  • The OpenSSH server is configured to allow key-based authentication.

About this task
Copy link

To preserve generated key pairs after you reinstall the system, back up the ~/.ssh/ directory before you create new keys. After reinstalling, copy it back to your home directory. You can do this for all users on your system, including root.

Procedure
Copy link

  1. Generate an ECDSA key pair: 
    $ ssh-keygen -t ecdsa
     
    Generating public/private ecdsa key pair.
Enter file in which to save the key (/home/<username>/.ssh/id_ecdsa):
Enter passphrase (empty for no passphrase): <password>
Enter same passphrase again: <password>
Your identification has been saved in /home/<username>/.ssh/id_ecdsa.
Your public key has been saved in /home/<username>/.ssh/id_ecdsa.pub.
The key fingerprint is:
SHA256:Q/x+qms4j7PCQ0qFd09iZEFHA+SqwBKRNaU72oZfaCI <username>@<localhost.example.com>
The key's randomart image is:
+---[ECDSA 256]---+
|.oo..o=++        |
|.. o .oo .       |
|. .. o. o        |
|....o.+...       |
|o.oo.o +S .      |
|.=.+.   .o       |
|E.*+.  .  . .    |
|.=..+ +..  o     |
|  .  oo*+o.      |
+----[SHA256]-----+

    Alternative: Instead of ECDSA, you can generate:

    • an RSA key pair by using the ssh-keygen command without any parameter
    • an Ed25519 key pair by entering the ssh-keygen -t ed25519 command

      Note that the Ed25519 algorithm is not FIPS-140-compliant, and OpenSSH does not work with Ed25519 keys in FIPS mode.

  2. Copy the public key to a remote machine: 
    $ ssh-copy-id <username>@<ssh-server-example.com>
     
    /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
<username>@<ssh-server-example.com>'s password:
…
Number of key(s) added: 1

Now try logging into the machine, with: "ssh '<username>@<ssh-server-example.com>'" and check to make sure that only the key(s) you wanted were added.

    Replace <username>@<ssh-server-example.com> with your credentials.

    If you do not use ssh-agent, the command copies the most recently modified ~/.ssh/id*.pub public key. To use a different public-key file, or to prefer keys from files over keys stored in memory by ssh-agent, use the ssh-copy-id command with the -i option.

Results
Copy link

  1. Log in to the OpenSSH server by using the key file: 
    $ ssh -o PreferredAuthentications=publickey <username>@<ssh-server-example.com>

Set key-based authentication as the only method on an OpenSSH server
Copy link

To improve system security, enforce key-based authentication by disabling password authentication on your OpenSSH server.

Before you begin
Copy link

  • The openssh-server package is installed.
  • The sshd daemon is running on the server.
  • You can already connect to the OpenSSH server by using a key.

    See the Generating SSH key pairs section for details.

About this task
Copy link

Warning

If you disable password authentication without ensuring that key-based authentication works correctly, you can lock yourself out of the server. Test your SSH key authentication thoroughly before applying this configuration, and keep a current session open while testing to revert changes if necessary.

Procedure
Copy link

  1. Open the /etc/ssh/sshd_config configuration in a text editor, for example: 
    # vi /etc/ssh/sshd_config
  2. Change the PasswordAuthentication option to no: 
    PasswordAuthentication no
  3. On a system other than a new default installation, check that the PubkeyAuthentication parameter is either not set or set to yes.
  4. Set the KbdInteractiveAuthentication directive to no.

    The corresponding entry is commented out in the configuration file and the default value is yes.

  5. To use key-based authentication with NFS-mounted home directories, enable the use_nfs_home_dirs SELinux boolean: 
    # setsebool -P use_nfs_home_dirs 1
  6. Reload the sshd daemon to apply the changes: 
    # systemctl reload sshd
  7. If you are connected remotely, test the configuration by opening a new SSH session in a separate terminal while keeping your current session open. If the new connection fails, you can revert the changes in your existing session.

Results
Copy link

  1. Confirm that password authentication is disabled: 
    # sshd -T | grep -i passwordauthentication
     
    passwordauthentication no
  2. Confirm that keyboard-interactive authentication is disabled: 
    # sshd -T | grep -i kbdinteractiveauthentication
     
    kbdinteractiveauthentication no
  3. From a different system, attempt to connect using password authentication to verify it is rejected: 
    $ ssh -o PreferredAuthentications=password <username>@<server>
     
    <username>@<server>: Permission denied (publickey).

    The connection is rejected because only public key authentication is allowed.

Authenticate by SSH keys stored on a smart card
Copy link

Use SSH keys stored on a smart card for authentication to add a physical layer of protection to your credentials. This method provides enhanced security against unauthorized access.

Before you begin
Copy link

  • On the client side, the opensc package is installed and the pcscd service is running.

About this task
Copy link

You can create and store ECDSA and RSA keys on a smart card and authenticate by the smart card on an OpenSSH client. Smart-card authentication replaces the default password authentication.

Procedure
Copy link

  1. List all keys provided by the OpenSC PKCS #11 module including their PKCS #11 URIs and save the output to the keys.pub file: 
    $ ssh-keygen -D pkcs11: > keys.pub
  2. Transfer the public key to the remote server. Use the ssh-copy-id command with the keys.pub file created in the previous step: 
    $ ssh-copy-id -f -i keys.pub <username@ssh-server-example.com>
  3. Connect to <ssh-server-example.com> by using the ECDSA key. You can use just a subset of the URI, which uniquely references your key, for example: 
    $ ssh -i "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so" <ssh-server-example.com>
     
    Enter PIN for 'SSH key':
[ssh-server-example.com] $

    Because OpenSSH uses the p11-kit-proxy wrapper and the OpenSC PKCS #11 module is registered to the p11-kit tool, you can simplify the previous command:

    $ ssh -i "pkcs11:id=%01" <ssh-server-example.com>
     
    Enter PIN for 'SSH key':
[ssh-server-example.com] $

    If you skip the id= part of a PKCS #11 URI, OpenSSH loads all keys that are available in the proxy module. This can reduce the amount of typing required:

    $ ssh -i pkcs11: <ssh-server-example.com>
     
    Enter PIN for 'SSH key':
[ssh-server-example.com] $
  4. Optional: You can use the same URI string in the ~/.ssh/config file to make the configuration permanent: 
    $ cat ~/.ssh/config
     
    IdentityFile "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so"
     
    $ ssh <ssh-server-example.com>
     
    Enter PIN for 'SSH key':
[ssh-server-example.com] $

    The ssh client utility now automatically uses this URI and the key from the smart card.