Creating SSH Keys for your Raspberry Pi Server
- How to use SSH with your Raspberry Pi
- Raspberry Pi Server Basics
- How to delete un-needed software from your Raspberry Pi Server
Add a new user with admin privileges
You can replace your own name with demo.
You will be asked to enter a password and some other details.
In order to grant admin privileges to our newly created user we will use the following command.
gpasswd -a demo sudo
Creating SSH Keys for authentication
Definition. SSH uses public-key cryptography to authenticate the remote computer and allow it to authenticate the user, if necessary. There are several ways to use SSH; one is to use automatically generated public-private key pairs to simply encrypt a network connection, and then use password authentication to log on.
This step is going to show you how to manually create a public and private SSH key for your local computer and Raspberry Pi.
Authorized keys are public keys that grant access. They are analogous to locks that an identity key (private key) can open. Authorized keys are configured for an SSH server.
Identity keys are private keys that an SSH client uses to authenticate itself when logging into an SSH server. Source.
Initially we are going to create our key pair. We do this from our local machine. Exit your current SSH session with the following command.
You will see the following output. (assuming username is the name of the local user)
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/username/.ssh/id_rsa):
I decided to name my file rpi_key.
Next you will be prompted to enter a password for the account. If you leave this empty then you will not be prompted for a password when attempting to log into the server. I suggest you enter a password here as an additional security measure.
Now we need to copy the public key that has been generated on the local machine. First print the contents of the file to the terminal with the following command.
Select the content and copy to the clipboard.
Next we need to SSH back into the RPi as the root user.
Once you have logged in type the following command.
su - demo
Where demo is the name of the user you created. This will switch to the home directory of that user.
Next we will create a .ssh file and restrict it’s permissions.
chmod 700 .ssh
Now create a new file called authorized_keys within the .ssh folder. We can do this like so:
This will open a new file called authorized_keys within the Vim editor.
Press ‘i’ to enter insert mode and then paste the clipboard into the editor with ctrl-v. Next type ‘:w’ to write to the file followed by ‘:q’ to exit the editor and return to the terminal.
To return to the root user type:
Now that we have created a new user with admin privalges and enabled SSH keys for further authientication we have no reason to be logging into the root user as this is an un-needed security risk.
Lets open the sshd config file again and remove the ability to log in as root user.
Find the line that looks like:
press ‘i’ to enter insert mode and make the following changes
Type ‘:w’ to write to the file and ‘:q’ to quit Vim and return to the terminal.
Next, restart the SSHD service.
service ssh restart
In order to check that everything is working open a new terminal window (leave the current root user logged in and the current terminal window open).
Within the new terminal window log into your newly created user account.
Assuming a succesful log in you can now close your root terminal window.
In order to run commands with admin privileges you will need to use the sudo command.