Move to keys and close the door behind you

short · 30 min · Objective 3.3

Task

Set up key-based SSH, disable password authentication, and do it in the order that does not lock you out. Then reproduce the permission error that produces the unhelpful "Permission denied" and find its real cause in the server log.

Steps

  1. From the client, generate a key pair with ssh-keygen -t ed25519 and copy the public half with ssh-copy-id user@server.
  2. Confirm key login works in a NEW session while keeping your current one open. Only now proceed.
  3. Break the permissions deliberately: chmod 777 ~/.ssh on the server and attempt a key login. It fails with "Permission denied" on the client.
  4. Read the real reason on the server: journalctl -u sshd reports bad ownership or modes. Fix with chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys and confirm login works.
  5. Validate a config change before applying it: edit sshd_config to set PasswordAuthentication no and PermitRootLogin no, run sshd -t, then systemctl reload sshd rather than restart. Then check what is actually in force with sshd -T: on RHEL 9 (and Ubuntu) sshd_config opens with Include /etc/ssh/sshd_config.d/*.conf, sshd keeps the FIRST value it reads for a setting, and a drop-in there -- cloud images often ship one saying PasswordAuthentication yes -- silently beats your edit further down. If it does, put your settings in a drop-in that sorts first.
  6. Confirm from the client that password login is now refused and key login still works.
  7. Add AllowUsers naming only yourself, reload, and confirm an unlisted user is refused. The client still sees the normal authentication dialogue -- sshd does not reveal which users exist -- but the server decided at once, and says why in its log: journalctl -u sshd shows User ... not allowed because not listed in AllowUsers.

Verify

sshd -t && echo "config valid"
sshd -T | grep -Ei 'passwordauthentication|permitrootlogin|allowusers'
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@server true 2>&1 | grep -qi 'permission denied' && echo "password auth disabled"
ssh -o PreferredAuthentications=publickey user@server true && echo "key auth works"

The last two must both hold: password refused, key accepted. Run sshd -t before every reload -- a syntax error plus a restart plus a closed session is the classic way to need the console.

Notes

The permission error in step 3 is the single most common SSH key failure and the client is told nothing useful about it on purpose. The habit that saves you is the one in step 2: prove a new session works before you close the one you have.

This is an independent study companion for CompTIA Linux+ and is not produced by or endorsed by CompTIA.