Encrypt Data with OpenSSH & Auto-Login with PuTTY
Having Set Up A Terminal Connection using PuTTY and OpenSSH for our Windows PC to Linux VPS host, let’s secure that link using authentication keys and, at the same time, enabling a simple password-free login.
Basically, you have the link, and you have your VPS username, so are positioned to take the next step: to create a pair of keys, one for the local box, the other for the Linux server.
Setup Unmanaged VPS: The Ubuntu-Nginx Guide
Take your virtual private server from zero to hero
.. from blank box to cute-as server ..
with this easy-to-follow copy/paste guide.
22+ parts with video, here’s the index.
Encrypt Data with OpenSSH & Auto-Login with PuTTY
Allow me to spell out the beauty of this solution and, if I may, to pay tribute to the wise heads that produced the solution.
- These keys – this keyset – rely on each other to work, unlocking a unique connection.
- Because you no longer need it, we can disable your VPS’ password access. (A little tweak in Harden the Secure Shell (SSH) & Create a Firewall.)
- Other than those ports needed for websites and the like, only your key can achieve server access.
- What’s more, you can password-protect the local one, giving that password (actually, it’s a passphrase but same thing really) just once per local PC login (unless you choose to expire your local key.) You will see the value of this.
- And because we’re using super-duper SSH, care of the OpenSSH app, our easy-peasy link is scrambled, tunnelled.
When you think about the power of that, I have to say, it’s no wonder geeks get geeky! I mean, it’s pretty damn decent. Simple in theory, effective in practise.
So that’s nice.
Aside from the security factor, this keyset thing is a mighty handy time-saver because, in setting up our remote server, let alone managing it, there sure is a lot of logging in and out.
Have a video:-
Video: Easy PuTTY Login with Keys
Watch the, er, guvideo for a better idea of how to do this.
Now then. Do pay attention, there’s a good fellow. Some of this is fiddly and unforgiving. If you’re not precise, it won’t work.
Generate Public and Private Keys with PuTTYgen
On your Windows PC, click Start > All Programs > PuTTY > PuTTYgen, and open it up.
Ensuring Parameters is set to SSH-2 RSA, click Generate. While generating, move the cursor about as directed, to create a random set of keys.
Copy the public key, as highlighted here, to a text file. DON’T COPY the end of the line (referred to as the Key comment) which begins rsa-key- followed by the date, ie rsa-key-20090330 in this image.
Enter and confirm a Key passphrase and click Save private key. Save the file in a local folder.
Don’t Pass up on a Passphrase
Should you close Pageant (another PuTTY module that we come to below) or reboot Windows, which closes Pageant in turn, then the next time you open it you’ll be prompted to give your passphrase. You can skip even this process, by not adding a passphrase in the above sequence. But. I recommend against this.
As it is, with the method outlined in this tutorial, the only security credential you will have to give manually is the passphrase, once per Pageant session (generally the same as a Windows session, from boot up to shut down). If you leave that out, and a hacker obtains your local, private key, then your server is legs akimbo. Then again, if you have a passphrase, and your key and IP details are stolen, the hacker must still guess your passphrase.
Of course, you can also sprinkle some $pEc1al characters into your passphrase as well.
Add the Public Key to Your Remote VPS
Login to your remote Linux box, using your new username, not root.
First, we create the directory to hold the public key file, so at the CLI, type:-
Now, we create the key file. Open a new file with the Nano text editor (far nicer than Vim, IMHO):-
As an aside, that dot before ssh, so .ssh in the folder path means the folder is hidden. It’s a Linux thing.
Second, paste the public key that you copied previously within the new text file.
Ensure there is only 1 space after ssh-rsa (not the original carriage return), followed directly by the key code, as seen here… *
* NB As I said above, ensure that, at the end of the key code, you did not include the text beginning rsa-key-. If you copied correctly as I nagged about above, you’ll be fine.
Third, type CTRL-X to exit the Nano text file, then type y to confirm saving the file and hit return. .. And remember that method for saving text files in Nano. I won’t repeat it. Well, I might.
OK. Now we’ll give your username and your username’s personal group the ownership of the .ssh directory and its contents:-
.. where guv:guv is to be replaced by your username:group (likely the same word for each, definitely so if you followed Create a Linux User & Set Permissions). Swap my user directory, guv, for yours too, course.
.. and tighten security with some permissions:-
.. again swapping my user directory for yours.
How to Test Authentication Keys
Open PuTTY. Provide the following data under the Categories sections:-
- Connection > Data: For Auto-login username enter your new username (not root)
- Connection > SSH > Auth: Where it says Private key file…, browse for the private key we created above
- Session: For Host name (or IP address) add either of those; for Connection type select SSH; for Port select 22 (we’ll change that eventually in the next tutorial, if you’d been wondering)
- Session: For Saved sessions add a profile name of your choice, and click Save
Your profile name will have appeared in the larger box beneath Saved sessions, like this. Mine says ‘Guvnr Settings’..
Double click that new profile name, else select it and click Open.
The command line interface will open and, instead of asking for your user name and password, will ask for your passphrase. Give it, and you’re in.
Even Faster Login Using Pageant
Let’s streamline further, because otherwise the passphrase for every CLI instance is a pain.
On your Windows box, in a suitable directory, or perhaps on your desktop, do this:-
Right mouse click > New > Shortcut
In the dialogue box called Create Shortcut, it asks us to type the location of the item. We will include two items to open at the same time. One is that PuTTY module called Pageant, and the other is our private key.
…So, you need to locate those 2 files, pasting their locations to the Shortcut dialogue box. Your private key is wherever you browsed for it above, in PuTTY, so you know that. Pageant will be wherever you installed it, in the same folder as PuTTY, so you can find that. Typically, you will have something similar to this, and paste it accordingly:-
Type the location of the item: “C:\Program Files\PuTTY\pageant.exe” “C:\Documents and Settings\Administrator\Desktop\key\privatekey.ppk”
Click Next and give your shortcut a name, such as My Virtual Private Server.
Click Finish.
Now, and subsequently, the first time you want a remote CLI instance after a reboot of your local machine, double-click your new shortcut, and you will be prompted for your passphrase, so give that then.
Following that, a new icon will appear to the bottom right of your screen, next to the clock. This icon is a picture of a computer monitor wearing a hat, kinda like a spaghetti-western character.
Whenever you want a new CLI instance, right-click the icon, and select New session. As you can see, PuTTY pops up.
Under Saved sessions, double click on your new profile, and the CLI will open. You need type nothing to instigate this new and subsequent sessions until you close Pageant or reboot Windows.
More importantly, this means your authentication keys are working, and your dataflow is encrypted as well already.
How ruddy cool is that?
Review: Setting up the SSH Local-Remote Link – Windows vs Linux
You know, I don’t want to sound partisan, but if you’d followed the Linux guide rather than the Windows guide you’d have had that connection set up in about 10 minutes, rather than 1 hour and “er, is this gonna work?” Sorry, just the way it is.
After years of the MS marketers doing their job, these days I use and thoroughly recommend Ubuntu Desktop with XP (happily downgraded from Sheister Vista) running within it virtually, and they both have good and bad points.
.. well, Windows’ good point is actually Adobe, which bugs out on Linux, but there must be something else that’s good…..I guess I’ll have to get back to you on that. Haven’t tried Windows 7. I hear that’s good.
Tell you what though, here’s a tip, particularly as I suspect you will become somewhat fond of your Ubuntu Server (and believe you me their Desktop is a sinch by comparison): take a peek at another bible of mine, this time Ubuntu Desktop for Noobs:-
HOW-TO Install & Perfect Ubuntu 9.10 [KARMIC KOALA BIBLE #1 of 25] – GUVNR
.. Detailing every aspect over 25 parts, this reference guide helps you set up and use the ultimate installation of Ubuntu’s superb new operating system.
Besides, there are a raft of cross-over tips there that you can bring to your use of the terminal.
Now before I get myself on a total rant, and LOL I guess I sound like an ex-smoker talking tabs! …
And Now for Something Completely .. Similari-ssh!
That, my dears, is your connection set up. Possibly the most time-consuming element of this tutorial series, which is saying something considering we’re about to get high tech.
But having created our connectivity – beautifully, technically – it’s now time to use that connection, and secure the server itself.
In Harden the Secure Shell (SSH) & Create a Firewall we’ll concentrate and finalise your servers security settings, adding a firewall and tweaking the sshd_config file. It’ll take about 15 minutes or 5 if you’re quick. That’s a Linux thing 
Then, PHP5, MySQL, the superruddysexy Nginx web server, special configuration for platforms like WordPress, adding multi-sites & blogs, subversion, secure FTP, bits, bobs, fun, frolics. Anybody would think it was a Sunday. Index ..
Setup Unmanaged VPS: The Ubuntu-Nginx Guide
Take your virtual private server from zero to hero
with this easy-to-follow copy/paste guide.
“My local PC runs Windows” Show me for Linux
“My local PC runs Linux” Show me for Windows
22+ parts with video, here’s the index ..
-
Setup Unmanaged VPS: The Ubuntu-Nginx Guide
Introducing vpsBible’s how-to guide for setting up a super-charged unmanaged VPS featuring Ubuntu and Nginx.
-
VPS (Virtual Private Server) vs Shared vs Dedicated
Before getting stuck in, let’s compare the web host types in detail and weigh up the differences between managed & unmanaged VPS.
-
Set Up a VPS Linux Distribution
Opening a VPS hosting account, we’ll choose, configure & launch a Linux server ‘distribution’.
-
Set Up Command Line Interface (CLI) using PuTTY
Now we’ve got a server to play with, we’ll connect to it, using the ’ssh’ protocol for a super-secure link.
-
Create a Linux User & Set Permissions
Initially you’ve logged into your remote Linux machine as ‘root’. We’ll add you as a user now, with root or SuperUser permissions.
-
Encrypt Data with OpenSSH & Auto-Login with PuTTY
Now we can use ‘authentication keys’ to shore up our connection while simplifying login to an automated, password-free yet secure process.
-
Harden the Secure Shell (SSH) & Create a Firewall
The final security step: galvanizing the OpenSSH protocol and setting up an ‘iptables’ firewall. Now the server is rock ruddy solid.
-
Edit bashrc for User-Friendly Linux, plus System Updates
We use the terminal a whole lot so let’s cut ourselves a break and create some command shortcuts, then update the server.
-
Add a Domain Zone to Your VPS
To make your server aware of yourDomain.com you’ll need a few ‘DNS’ records. Damn this is simple I’m practically asleep!
-
Prepare Linux Server for Email with Postfix
In order to send and receive email from our web applications we’ll install some software and tweak the ‘RDNS’ record.
-
Install PHP5 & MySQL – The One-Stop FastCGI Index Page
Add PHP5 & MySQL, but which FastCGI method is best? Here’s the benchmarking, 4 ways to install/compile, add caching modules & more.
-
Nginx (better than Apache) Web Server
Let’s install this supersonic web server, tweaking its file structure & adding default configuration files.
-
Setup FileZilla for Secure FTP (SFTP)
There’s FTP, and then there’s ‘Secure FTP’. We’ll set up FileZilla using SFTP – and those authentication keys – for secure file transfers.
-
Serve Multiple Sites & Blogs with Virtual Hosts
We want a website folder structure, some permissions, some site-specific configuration files and, hey, we’ll hook up ‘FastCGI’.
-
Adding Sub-Domains with Nginx
Need a sub-domain? If you do, here’s how to add subDomain.yourSite.com with an ‘A record’ and a configuration file.
-
Integrate A CMS Like WordPress, WP MU, Drupal etc
For those of you wanting to use a specific content framework, such as a CMS, blogging or forum software, pop in here and we’ll sort that out.
-
Google Apps for Domain-Specific Email
GA’s free Standard Edition for catchall webmail – POP-ping or IMAP-ped to your desktop client – saves precious server resources for your webs.
-
Moving Day! How to Move Your Blog or Site
Nearly there. Here’s the web site or blog migration guide, relocating to your VPS with minimal or no downtime.
Manage Unmanaged VPS: Ubuntu-Nginx Administration
Already set it up? We’d best maintain it then.
Toggle to the .. Ubuntu-Nginx Admin Index
Manage Unmanaged VPS: Ubuntu-Nginx Administration
Maintain your virtual private server with ..
.. cheatsheets, tutorials, tips & guides.
Head back to the .. Ubuntu-Nginx Installation Index
-
Nginx Control Panel: Here’s the Deal
You’re migrating shared-to-VPS and want a GUI like cPanel? No you don’t, not after you read this! What’s more, you don’t need one either.
-
Nginx Control Panel Workarounds
For every control panel module there’s an equivalent (and faster) terminal command. Let’s compare these.
-
Upgrade to Nginx Latest Version with ZERO Downtime
Keep Nginx up-to-date – and optimized for security. This guide shows precisely how *with no missed server requests*.
-
Compile an Advanced Nginx Module Configuration
Need special web server functions? Here’s how to install or upgrade Nginx with bespoke required modules & parameters.
-
Add Web Sites Nginx Cheatsheet
Once you’ve set up your first site, adding more gets easier. Especially when you refer to this. (Let’s face it, I’m just too good to you.)
-
Adding Sub-Domains with Nginx
Rather than add somesite.tld, maybe you want some.subsite.tld? Here’s how to set your A record using a DNS manager and the vhost file for Nginx.
-
Add/Delete MySQL Database from Command Line
Need a database? Want to bin an old db? This tutorial shows you how using the terminal command line console whatnot.
-
Configure phpMyAdmin for Nginx to Maintain MySQL
Rather than have to crunch databases via the command line, we can make life easier by adding this splendid tool to manage them.
-
Backup/Export MySQL DB with CLI & mysqldump
Here’s how to backup a database from the command line using the handy mysqldump utility.
-
Import MySQL Database using Command Line
Import data to a new database with this simple mysqldump guide .. great for reinstating an old backed-up db, for instance.
-
Batch Replace/Delete Data in MySQL Database
Change repetitive db data with a single command. Rather than manually find & alter each instance, isolate the lot & update multiple content.
-
LOST a MySQL Password? How to RESET it
Lost your MySQL password? That’s a bit of a bummer .. or it would be if you didn’t have this new password setup guide, huh.
-
Backup or Upload with Secure Copy SCP (Linux to Linux)
Never mind FTP m8! Save time and download/upload your files using encrypted SCP (secure copy), the #1 Linux-Linux file transfer solution.
-
Backup or Upload with PuTTY PSFTP (Windows/Linux)
Equivalent to the above, how to transfer your files if you’re unlucky enough to be running Windows for your local PC. Not that I’m biased.
-
*USEFULLY* Park A Spare Domain with Nginx
Got a spare domain name sat around doing nothing? Put it to some use, have it point its traffic at your primary domain. Here’s the deal ..
-
Password Protect Nginx Web Files/Directories
Maybe you want a hidden website directory, say, for projects, or are developing a site and want it off-limits ’till launch day. Top tip ..
-
Redirect Web Pages with Nginx Rewrite Rule
Here’s the syntax to point a site or blog to another domain. That way, for instance, traffic from a passive site benefits an active one.
-
Nginx Error & Access Logs
Need to troubleshoot some error, or want to find out who’s trying to hack your site? Here’s a start .. those tell-tale logs.
-
Subversion for Easy CMS Updates ie WordPress/Drupal/etc
A brief introduction to install and know about the power of Subversion, the version control system to keep scripts and platforms up-to-date.
-
You Tell Me …
Something missing? Probably. Let me know what you’d like included. And if it’s listed below, shout out anyhow and I’ll try to bump it.
Nginx Admin: In the Works ..
This lot’s marked for addition already:-
- Setup or Edit DNS using Bind
- Network Tools Troubleshooting Guide
- The Comprehensive Permissions Guide
- Configuring Nginx Rewrites
- Custom Website Error Page
- Setting up Cron Jobs
- Rsync for Incremental Remote-to-Local Backup
- Cron & Rsync for Automatic Backup
- Cron & mysqldump for Auto DB Backup
- Safeguard Bandwidth with Hotlink Protection
- Block Access with Nginx’ IP Deny
Got a Question? Want to Comment?
This site has no comments system. We've got a better system!
Please use the link at the top of the post and goto this topic's forum thread:-
- to help build community
- for a superior knowledge base
- to keep info in one place, not diluted between forum & comments.
For those posts ported from Guvnr.com (pre-Feb/2010), archive comments remain.
Handy info from these comments is in the process of being ported to the forum and attributed to the original author.
If you think this idea sucks, let me know.
Thank you.
Tarak August 2nd, 2009 at 5:36 am
Questions (oh wonderous guru – thats the ego booster) – I have an unmanaged VPS (Debian 5) and been wonder in the abyss of linux for a few months doin things half hearted – time to get the house in order:
1. Do I have to do things in the order of your tutorial (eg – I’ve been using root now created a super user – do I need to reistal MySQL etc?)
2. (tute 5 – encryption) will this limit me to accessing the VPS only from one machine – be great if I could keep everything on a USB stick.
– ego boosting aside – these are brilliant tutorials – thanks
the_guv August 2nd, 2009 at 12:40 pm
@Tarak .. big tx, most kind of you, Sir.
There are some things that should be done in order, others won’t matter. If you are in any doubt, I advise you go in order. Then again, in your case, it *sounds* like you needn’t reinstall MySQL. Then again, again!, for the sake of a couple of hours, from A-Z, you could learn a lot from going in order and having less headache along the way .. follow the guide word for word, and there will be no headache, it’s all thoroughly tested.
Re Part 5, openSSH can be set up in many ways but, jolly convenient, you can share your private key between local machines, or even on a storage card for convenience. Just read the security caveats I’ve mentioned, er, in Part 6 as well I think.
If you have specific problems let me know. Also, for Debian, the Ubuntu forums are your friend. Great community there.
Breaker August 26th, 2009 at 7:20 am
Guvnr, a million thanks for this guide… very useful.
I’m decently linux literate, but Putty/SSH/RSA and “live server” green. I believe I followed every step in this chapter to a T, but not without snags.
as root: When attempting chmod 600 ~/.ssh/authorized_keys
I get a:
chmod: cannot access ‘/root/.ssh/authorized_keys’: No such file or directory
Any thoughts? Should I replace ‘~/’ with ‘/home/’?
I attempted that… and continued – the new PuttyCLI resulted in a “The server refused our key” response.
Any input would be greatly appreciated.
Ashesh August 27th, 2009 at 8:43 am
Hi Guvnr,
What a wonderful person you are. Thanks a lot of such a useful guide.
Just got an error while setting up public key so thought to inform you.
It seems only copying the whole text of public key works rather “NB As I said above, ensure that, at the end of the key code, you did not include the text beginning rsa-key-.” instructed by you. I might be wrong because I have been trying for last two hours. Another thing I did was “chmod 700 .ssh”. I do not know if any one of them or both made the thing work.
Thanks again for this bible.
the_guv August 27th, 2009 at 12:36 pm
@Ashesh & @Breaker .. thx very much.
Damn, I cocked up here. Really sorry everyone. Dunno why but I left out some important steps. What a bozo
It should all be working fine now.
Thank you for for bringing this to my attention.
Ben September 18th, 2009 at 3:05 pm
Wow, so glad I found this site! VERY well put togther, followed this step by step and now have secure login via pagent.
Was following another tutorial on ssh keys on another site, and nowhere near as easy as this.
Onto the next step….keep you the good work, its aprpeciated.
Install/Upgrade WORDPRESS with SUBVERSION - VPS Bible #15 - GUVNR November 2nd, 2009 at 12:02 am
[...] Encrypt Data with OpenSSH & Auto-Login with PuTTY * [...]
Alaettin December 28th, 2009 at 11:25 pm
Hey,
That is really good tutorial serie. Actually, this is the best I’ve ever seen. I see now why linux is much better than windows. I was thinking of installing debian but this tutorial changed my mind. I will go with Ubuntu and make it sharp with this “bible”.
I think that you are the super-hero of all noob sysadmins!
Configure FileZilla’s SFTP – better than FTP: VPS BIBLE - vpsBible April 23rd, 2010 at 4:59 pm
[...] up our connection using the password-protected private authentication key we created in the guide Encrypt Data with OpenSSH & Auto-Login with PuTTY. In other words, with a couple of clicks, you’re into your SFTP in just the same way we log [...]
LOCK LINUX! – Configure SSH & an iptables Firewall: VPS BIBLE - vpsBible May 18th, 2010 at 11:21 am
[...] the last part of this series Encrypt Data with OpenSSH & Auto-Login with PuTTY we secured dataflow between our local to remote machines, as well as simplifying the login process. [...]