How to Generate & Set Up SSH Keys on CentOS 7?

Introduction

In today's digital age, secure communication is a top priority for individuals and businesses alike. When sensitive data is transmitted over the internet, it is important that it remains confidential and protected from unauthorized access. This is where SSH keys come in.

SSH keys are a type of authentication method used to establish a secure connection between two networked devices. They are cryptographic keys that enable secure data transmission through encryption.

Unlike traditional username/password authentication methods, SSH keys are much more secure. Passwords can be guessed or hacked, but SSH key pairs are nearly impossible to break.

Generating SSH Keys on CentOS 7

A Key to Secure Communication

SSH keys are crucial in establishing secure communication between two systems. They are essentially a pair of cryptographic keys – public and private – that can be created using the ssh-keygen command.

The private key is kept on the client system, while the public key is copied to the server(s) that the client wishes to access. When the client tries to connect to a server, it sends its public key along with a request for authentication.

Step-by-Step Guide

The process of generating SSH keys on CentOS 7 involves using the ssh-keygen command, which is pre-installed in most Linux distributions including CentOS 7. To generate an RSA (Rivest-Shamir-Adleman) type SSH key pair, follow these steps −

• Open up your terminal or command prompt.

• Type `ssh-keygen` and press enter.

• You will see a prompt asking where you would like to save your new keys. The default location is usually fine, so just press enter.

• You will also be prompted for a passphrase (password). It's generally recommended that you choose something strong here since if someone were able to get access to your private key they would have full access as if they were you!

• Press enter twice more when prompted for an empty passphrase (unless you want one). You have now successfully generated your RSA SSH keys!

Options Available During Key Generation

During the generation process, there are several options available that offer additional control over how your SSH keys are created. For example −

• Key type − RSA is the default option, but you can also generate keys using DSA (Digital Signature Algorithm) or ECDSA (Elliptic Curve Digital Signature Algorithm). - Key size: The default key size for RSA and DSA is 2048 bits, but you can increase this if you need more security.

• Passphrase − A passphrase is optional, but it adds another layer of security to your SSH keys. Make sure to choose a strong passphrase that includes upper and lower case letters, symbols, and numbers.

Setting Up SSH Keys on CentOS 7

Copy Public Key to Remote Server Using ssh-copy-id Command

After generating your SSH keys, the next step is to copy your public key to the remote server that you want to access. The easiest way to do this is by using the ssh-copy-id command. This command automatically copies your public key to the remote server's authorized_keys file, which allows you to authenticate with your private key.

The syntax for using this command is as follows −

ssh-copy-id username@remote_server_ip_address 

Replace "username" with the username of the account that you want to access on the remote server, and "remote_server_ip_address" with its IP address or domain name. You will be prompted for your password on the remote server during this process.

Alternative Methods for Copying Public Key

If you cannot use ssh-copy-id for some reason (e.g., it's not installed on the local or remote system), there are alternative methods for copying your public key manually. One way is by using a text editor and copy-pasting your public key into a new line in the authorized_keys file on the remote server. To do this, follow these steps −

• Open a new terminal window and navigate to the directory where your public key is located.

• Use cat or more command to view its content −

cat ~/.ssh/id_rsa.pub 

• Copy all contents of this file.

• Log in as root or use sudo su and open an SSH configuration file in nano −

nano ~/.ssh/authorized_keys 

• Paste copied content here.

• Save changes and close nano.

Troubleshooting Common Issues During Setup Process

There are several common issues that can occur during the setup process for SSH keys. One of the most common is incorrect permissions on the authorized_keys file or its parent directory. This can prevent your public key from being copied to the authorized_keys file, or prevent you from accessing the remote server with your private key.

To fix this issue, make sure that the permissions on both the .ssh directory and authorized_keys file are set to 700 and 600 respectively −

chmod 700 ~/.ssh 
chmod 600 ~/.ssh/authorized_keys 

Another issue that can occur is an incorrect format for your public key in the authorized_keys file.

Make sure that your public key is formatted correctly with no line breaks, and that it's placed on a single line in this file. If you encounter any other issues during this process, check logs in /var/log/secure on your CentOS system to find helpful information about what went wrong.

Advanced Topics in SSH Key Management

Overview of Different Types of SSH Keys (e.g. RSA, DSA, ECDSA)

SSH keys come in many different types, each with its own unique set of characteristics that can make it better suited for certain use cases. The three most commonly used types of SSH keys are RSA, DSA, and ECDSA. RSA is the most widely used type of SSH key and supports key sizes ranging from 1024 to 4096 bits.

It is considered secure and reliable for most purposes. DSA keys are less widely used but offer faster signing and verification times than RSA keys.

However, DSA is limited to a maximum key size of 1024 bits and is considered less secure than RSA. ECDSA is a newer type of SSH key that uses elliptic curve cryptography instead of the more traditional methods used by RSA and DSA.

It offers faster signing times and smaller key sizes while maintaining strong security properties. However, it may not be supported by all servers or clients.

Using Multiple Keys for Different Servers or Purposes

It's common for users to have multiple servers they need to access using SSH keys, each with its own set of requirements (e.g., different usernames or passphrases). In these cases, it's important to use separate keys for each server to minimize the risk if one key is compromised. To use multiple SSH keys on one client machine, you will need to create separate private/public key pairs using a unique filename for each pair (e.g., id_rsa_server1).

Then you can specify which key should be used when connecting to a particular server by setting up your ssh config file with options such as IdentityFile. Another use case for multiple keys is when accessing different services or applications that require authentication via SSH.

For example, you may have one set of keys for accessing a Git repository and another set of keys for logging into a remote server. By using separate keys, you can minimize the risks associated with one key being compromised.

Conclusion

In this article, we walked through the steps for generating and setting up SSH keys on CentOS 7. We explored the importance of SSH keys in secure communication and the benefits of using them for authentication. When generating SSH keys, it's important to choose a strong passphrase that cannot be easily guessed or brute-forced.

In addition, we covered different methods for copying public keys to remote servers and troubleshooting common issues during setup. It's critical to regularly update and rotate your SSH keys to maintain their security.