-->
Apr 02, 2019 The first step in the installation process is to create the key pair on the client machine, which would, more often than not, be your own system. Users need to use the following command: ssh-keygen -o -b 4096 -t rsa. The above command kicks off the SSH Key installation process for users. Dec 18, 2019 Using SSH keys is more secure and convenient than traditional password authentication. In this tutorial, we will walk through how to generate SSH keys on Ubuntu 18.04 machines. We will also show you how to set up an SSH key-based authentication and connect to your remote Linux servers without entering a password. Creating SSH keys on Ubuntu #.
With a secure shell (SSH) key pair, you can create virtual machines (VMs) in Azure that use SSH keys for authentication, eliminating the need for passwords to sign in. This article shows you how to quickly generate and use an SSH public-private key file pair for Linux VMs. You can complete these steps with the Azure Cloud Shell, a macOS or Linux host, the Windows Subsystem for Linux, and other tools that support OpenSSH.
Note
VMs created using SSH keys are by default configured with passwords disabled, which greatly increases the difficulty of brute-force guessing attacks.
For more background and examples, see Detailed steps to create SSH key pairs.
For additional ways to generate and use SSH keys on a Windows computer, see How to use SSH keys with Windows on Azure.
Supported SSH key formats
Azure currently supports SSH protocol 2 (SSH-2) RSA public-private key pairs with a minimum length of 2048 bits. Other key formats such as ED25519 and ECDSA are not supported.
Create an SSH key pair
Use the ssh-keygen command to generate SSH public and private key files. By default, these files are created in the ~/.ssh directory. You can specify a different location, and an optional password (passphrase) to access the private key file. If an SSH key pair with the same name exists in the given location, those files are overwritten.
The following command creates an SSH key pair using RSA encryption and a bit length of 4096:
If you use the Azure CLI to create your VM with the az vm create command, you can optionally generate SSH public and private key files using the --generate-ssh-keys option. The key files are stored in the ~/.ssh directory unless specified otherwise with the --ssh-dest-key-path option. The --generate-ssh-keys option will not overwrite existing key files, instead returning an error. In the following command, replace VMname and RGname with your own values:
Provide an SSH public key when deploying a VM
To create a Linux VM that uses SSH keys for authentication, specify your SSH public key when creating the VM using the Azure portal, Azure CLI, Azure Resource Manager templates, or other methods:
If you're not familiar with the format of an SSH public key, you can display your public key with the following cat command, replacing ~/.ssh/id_rsa.pub with the path and filename of your own public key file if needed:
A typical public key value looks like this example:
If you copy and paste the contents of the public key file to use in the Azure portal or a Resource Manager template, make sure you don't copy any trailing whitespace. To copy a public key in macOS, you can pipe the public key file to pbcopy. Similarly in Linux, you can pipe the public key file to programs such as xclip.
The public key that you place on your Linux VM in Azure is by default stored in ~/.ssh/id_rsa.pub, unless you specified a different location when you created the key pair. To use the Azure CLI 2.0 to create your VM with an existing public key, specify the value and optionally the location of this public key using the az vm create command with the --ssh-key-values option. In the following command, replace VMname, RGname, and keyFile with your own values:
If you want to use multiple SSH keys with your VM, you can enter them in a space-separated list, like this --ssh-key-values sshkey-desktop.pub sshkey-laptop.pub.
SSH into your VM
Generate Key Code
With the public key deployed on your Azure VM, and the private key on your local system, SSH into your VM using the IP address or DNS name of your VM. In the following command, replace azureuser and myvm.westus.cloudapp.azure.com with the administrator user name and the fully qualified domain name (or IP address):
If you specified a passphrase when you created your key pair, enter that passphrase when prompted during the login process. The VM is added to your ~/.ssh/known_hosts file, and you won't be asked to connect again until either the public key on your Azure VM changes or the server name is removed from ~/.ssh/known_hosts.
If the VM is using the just-in-time access policy, you need to request access before you can connect to the VM. For more information about the just-in-time policy, see Manage virtual machine access using the just in time policy.
Next steps
For more information on working with SSH key pairs, see Detailed steps to create and manage SSH key pairs.
If you have difficulties with SSH connections to Azure VMs, see Troubleshoot SSH connections to an Azure Linux VM.
How to Generate Keys and What Are They?
Generating SSH key pair consists of two basic phases. The first phase is generating the key pair on the local side, the second phase is copying it to the remote host, registering in the server and configuring the ssh daemon to make it useful. A key pair consists of two files, id_rsa and id_rsa.pub which are private and public keys respectively. The public key resides on the server side, whereas the private key is used when accessing it over SSH protocol.
In the following example ssh-keygen command is used to generate the key pair. When generating the key pair, the command prompt asks a name for a key, if it’s omitted the default name – id_rsa is used instead.
How to Use the Keys?
Once the key pair is generated on the local side through terminal window, the next step is to prepare them for employing for authentication purpose. The most convenient way to upload and register the public key in the server is using the ssh-copy-id command, what it does is copy the public key to the given user account located in the given host. As seen in the following example when the ssh-copy-id, username, the host name along with the password are all given the public key is copied and registered on the server side. If the username is root, the public key is uploaded to /root/.ssh/ on the server.
That being said, the server still isn’t protected with the SSH key pair as it’s not configured properly. Anyone can still access to the server if the password of the user account is known; hence the password has to be disabled while enabling the key pair verification. To disable the password authentication, edit /etc/ssh/sshd_config file where the settings for the SSH daemon are contained. In the file, the PasswordAuthentication has to be altered to NO, ChallengeResponseAuthentication should be altered to No as well. As the next step the sshd daemon has to be restarted for changes to take effect, which can be done with sudo systemctl reload sshd. Finally, the new key pair authentication method can be tested by giving ssh username@username in the terminal window.
Theory of The Keys and How They Work
The key pair is a part of the SSH standard which is used to connect to a remote host over an unsecured network. As stated earlier, the key pair consists of two keys – public and private keys which are uploaded to the server side and kept on the client side respectively. The public key is denoted by .pub extension, and the private key doesn’t have any extension.
When the user is accessing the server, the SSH daemon installed on the server side requests the user for the SSH private key, if it’s provided the private key is compared against the public key in the server. If the private key corresponds to the public key, authentication is successful, otherwise it rejects the login request. By default, the key pair uses RSA which is a cryptographic algorithm to generate the keys. But there are other popular algorithms as well, such as DSA and ECDSA.
ssh-keygen Command Line Options
ssh-keygen is used to generate keys and it provides a number of options to ease the key pair management, tighten the security and increase the flexibility. The following options are some of the prominent options which may come handy when managing a server.
Passphrase
The Passphrase option is used to provide a secondary protection when a key pair is used to authenticate the user. What it does is to secure the private key with a password and consequently the user is required to provide the passphrase when logging in to the remote host. It asks during the key pair creation.
Change the Bit Strength
Linux User List
Bit strength refers to the key pair’s key size which defines how strong the key pair is. Nowadays the standard size is 2048 bits, but it used to be 1024 bits and is no longer acceptable as it’s speculated that many powerful hardware are capable of cracking anything up to 1024 bits or even above given the right amount of time. Fortunately, ssh-keygen currently supports higher bit strength values such as 2048 and its next fashionable number 4096 which is recommended if it’s possible due to the large bit strength. The bit strength value can be adjusted with –b command, if it’s omitted the default value – 1024 or 2048 depending on the ssh-keygen is used.
Comment Public Key
Commenting is applicable to the public key, and is useful in organizing the keys if there are a large number of keys involved. The typical usage of commenting is when multiple admins use a server, but still want to distinguish one key from another. The following format is used to add a comment when generating a key pair.
Change Passphrase of a Private Key
Like adding a passphrase when generating a key pair, the existing passphrase can also be changed. Since the passphrase is applicable to the private key which resides on the client side, the command has to be executed on the client side along with the name of the private key. This option takes 3 parameters, old password, new password and the private key to apply the changes.
Change the Cryptographic Algorithm
The Algorithm defines how the information in the key pair is encrypted in order to verify each other when the connection is being established. Ssh-keygen supports several popular algorithm types which are RSA, ECDSA, DSA, ED25519 and RSA1. Nowadays the popular algorithm among many servers is RSA due to its wide spread usage and relatively good security, however it’s currently being upgraded to the newer version ECDSA which is much lighter, and has a low bit value with a high security compared to RSA. ED25519 is the newest version among these, and therefore not many clients support it, but still server side implementation is possible at the moment. DSA is the oldest version among all these algorithms, and is no longer employed in most of the hosts as it’s not secure anymore. According to OpenSSH 7 standard the support for DSA will no longer be given. The format to use the algorithm is as following.