SSH is very important for improved security when connecting to your pi. There are some unusual problems that may occur which are addressed in the Hints section. The Advanced and Optional section provides guidance to some more advanced SSH settings and methods. Some of these are for improved security and should not really be considered optional.
Advanced and Optional Overview
Advanced and Optional Procedures
Some general rules to security are:
- Do not use default passwords
- Use multifactor authentication
- Do not provide shell access unless it is needed
- Do not provide services you do not need
- Do not needlessly expose services
- Apply security patches
- Prevent physical access
- Use quality cryptology
There are a few SSHd configuration changes that will improve SSH security. Since SSHd is likely a service you do want to provide and it gives shell access, this is important.
- Edit the configuration file,
sudo nano /etc/ssh/sshd_config
Change the following:
Add the following:
AllowUsers pi # Even better if you use a non-default user
Using public key authentication will greatly improve your SSHd security but sometimes seems complicated. Do it anyways.
- Generate a password protected key pair,
You will be asked the name of the key file and the password to unlock the key. I usually name my key file according to the system it is used to connect to. The process should look something like this:
Generating public/private rsa key pair. Enter file in which to save the key (/home/user/.ssh/id_rsa): /home/user/.ssh/id_rsa_hostname Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/user/.ssh/id_rsa_hostname. Your public key has been saved in /home/user/.ssh/id_rsa_hostname.pub. The key fingerprint is: ac:6a:0f:32:2e:bd:aa:3d:46:cc:c0:21:cc:68:47:40 user@computer The key's randomart image is: +---[RSA 2048]----+ |=Eo. | |o= . | |+ o | |.. . | | + S | | + . | | oo . . | |.o+o.o | |++++... | +-----------------+
- Copy your public key to the pi,
ssh-copy-id -i ~/.ssh/id_rsa_hostname.pub email@example.com.
You should see something like the following and also be asked for your password.
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys firstname.lastname@example.org's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'email@example.com'" and check to make sure that only the key(s) you wanted were added.
- Go ahead and
ssh 'firstname.lastname@example.org. You should be asked for the password for your key.
An excellent resource for learning more is from archlinux
- Start PuTTYgen
- Change the Number of bits in a generated key to 2048.
- Click Generate to generate a new key pair.
- Add a password to the Key passphrase and Confirm passphrase.
- Save your public and private keys. The private key should not be shared but the public key may be freely shared.
- On the pi,
- Copy the public key from the Windows PuTTYgen box and paste it into the authorized_keys file on your pi. Save the file.
- Close PuTTYgen.
- Open PuTTY.
- Save a new session named hostname and put hostname.local in the Host Name box.
- From the configuration Categories, select Connection >> SSH >> Auth.
- Browse to select the private key you created earlier for authentication.
- Save the session.
- Test by clicking Open.
- You should be required to enter in the username to log in with and also the password used to protect the key.
NOTE: Do not lose your private keys. Once the next configuration steps are complete, your private key and password are required to login remotely. You will still be able to login from the console or with a keyboard and monitor.
Time now to only allow remote logins using public key authentication. This configuration is on your pi.
- Open the file,
sudo nano /etc/ssh/sshd_config
Add the following lines to the file and save:
PasswordAuthentication no ChallengeResponseAuthentication no UsePAM no PubkeyAuthentication yes
- Reload the sshd configuration,
sudo service sshd reload
Test by trying to login without the key file.
for Chrome app Secure Shell
When working with pies in a closed network, there are times when the host identification will change. When that happens, attempts to connect using the Secure Shell app will fail with the following message:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is d6:be:12:7e:22:23:c3:e1:56:30:d6:cd:65:b7:ab:42. Please contact your system administrator. Add correct host key in /.ssh/known_hosts to get rid of this message. Offending ECDSA key in /.ssh/known_hosts:7 ECDSA host key for xxxxxxxxxxxxx.yyy.au has changed and you have requested strict checking. Host key verification failed. NaCl plugin exited with status code 255. (R)econnect, (C)hoose another connection, or E(x)it?
This can only be fixed by removing the offending key. Make note of the number shown at the end of the line, Offending ECDSA key in /.ssh/known_hosts:7. That number depends on your system and is the index of the offending key.
CTRL +Shift +J
term_.command.removeKnownHostByIndex(INDEX);into the console. Replace INDEX by the index of your offending key.
- Clear all host keys with