How To Securely Manage Secrets with HashiCorp Vault on Ubuntu 16.04


SSH, or safe shell, is an encrypted protocol used to manage and talk with servers. When working with an Ubuntu server, likelihood is you’ll spend most of your time in a terminal session related to your server by way of SSH.

On this information, we’ll give attention to establishing SSH keys for a vanilla Ubuntu 16.04 set up. SSH keys present a straightforward, safe means of logging into your server and are really useful for all customers.

Step 1 — Create the RSA Key Pair

Step one is to create a key pair on the consumer machine (often your laptop):

By default ssh-keygen will create a 2048-bit RSA key pair, which is safe sufficient for many use circumstances (you'll be able to optionally go within the -b 4096 flag to create a bigger 4096-bit key).

After coming into the command, you need to see the next immediate:


Enter file by which to avoid wasting the important thing (/your_home/.ssh/id_rsa):

Press enter to avoid wasting the important thing pair into the .ssh/ subdirectory in your house listing, or specify an alternate path.

It's best to then see the next immediate:


Enter passphrase (empty for no passphrase):

Right here you optionally might enter a safe passphrase, which is very really useful. A passphrase provides a further layer of safety to forestall unauthorized customers from logging in. To study extra about safety, seek the advice of our tutorial on How To Configure SSH Key-Primarily based Authentication on a Linux Server.

It's best to then see the next output:


Your identification has been saved in /your_home/.ssh/id_rsa. Your public key has been saved in /your_home/.ssh/ The important thing fingerprint is: a9:49:2e:2a:5e:33:3e:a9:de:4e:77:11:58:b6:90:26 [email protected]_host The important thing's randomart picture is: +--[ RSA 2048]----+ | ..o | | E o= . | | o. o | | .. | | ..S | | o o. | | =o.+. | |. =++.. | |o=++. | +-----------------+

You now have a private and non-private key that you need to use to authenticate. The following step is to put the general public key in your server as a way to use SSH-key-based authentication to log in.

Step 2 — Copy the Public Key to Ubuntu Server

The quickest solution to copy your public key to the Ubuntu host is to make use of a utility known as ssh-copy-id. On account of its simplicity, this methodology is very really useful if out there. In case you shouldn't have ssh-copy-id out there to you in your consumer machine, you might use one of many two alternate strategies offered on this part (copying by way of password-based SSH, or manually copying the important thing).

Copying Public Key Utilizing ssh-copy-id

The ssh-copy-id device is included by default in lots of working methods, so you will have it out there in your native system. For this methodology to work, you could have already got password-based SSH entry to your server.

To make use of the utility, you merely have to specify the distant host that you simply wish to hook up with and the person account that you've got password SSH entry to. That is the account to which your public SSH key might be copied.

The syntax is:

  • ssh-copy-id username@remote_host

You might even see the next message:


The authenticity of host ' (' cannot be established. ECDSA key fingerprint is fd:fd:d4:f9:77:fe:73:84:e1:55:00:advert:d6:6d:22:fe. Are you certain you need to proceed connecting (sure/no)? sure

Because of this your native laptop doesn't acknowledge the distant host. This may occur the primary time you hook up with a brand new host. Kind "yes" and press ENTER to proceed.

Subsequent, the utility will scan your native account for the key that we created earlier. When it finds the important thing, it should immediate you for the password of the distant person's account:


/usr/bin/ssh-copy-id: INFO: making an attempt to log in with the brand new key(s), to filter out any which might be already put in /usr/bin/ssh-copy-id: INFO: 1 key(s) stay to be put in -- if you're prompted now it's to put in the brand new keys username@'s password:

Kind within the password (your typing won't be displayed for safety functions) and press ENTER. The utility will hook up with the account on the distant host utilizing the password you offered. It can then copy the contents of your ~/.ssh/ key right into a file within the distant account's residence ~/.ssh listing known as authorized_keys.

It's best to see the next output:


Variety of key(s) added: 1 Now strive logging into the machine, with: "ssh 'username@'" and examine to ensure that solely the important thing(s) you needed have been added.

At this level, your key has been uploaded to the distant account. You may proceed on to Step 3.

Copying Public Key Utilizing SSH

In case you shouldn't have ssh-copy-id out there, however you might have password-based SSH entry to an account in your server, you'll be able to add your keys utilizing a standard SSH methodology.

We are able to do that by utilizing the cat command to learn the contents of the general public SSH key on our native laptop and pipe that by way of an SSH connection to the distant server. On the opposite facet, we are able to ensure that the ~/.ssh listing exists below the account we're utilizing after which output the content material we piped over right into a file known as authorized_keys inside this listing.

We are going to use the >> redirect image to append the content material as an alternative of overwriting it. This may allow us to add keys with out destroying beforehand added keys.

The total command seems to be like this:

  • cat ~/.ssh/ | ssh username@remote_host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

You might even see the next message:


The authenticity of host ' (' cannot be established. ECDSA key fingerprint is fd:fd:d4:f9:77:fe:73:84:e1:55:00:advert:d6:6d:22:fe. Are you certain you need to proceed connecting (sure/no)? sure

Because of this your native laptop doesn't acknowledge the distant host. This may occur the primary time you hook up with a brand new host. Kind "yes" and press ENTER to proceed.

Afterwards, you have to be prompted to enter the distant person account password:


username@'s password:

After coming into your password, the content material of your key might be copied to the top of the authorized_keys file of the distant person's account. Proceed on to Step Three if this was profitable.

Copying Public Key Manually

In case you shouldn't have password-based SSH entry to your server out there, you'll have to full the above course of manually.

We are going to manually append the content material of your file to the ~/.ssh/authorized_keys file in your distant machine.

To show the content material of your key, sort this into your native laptop:

You will note the important thing's content material, which ought to look one thing like this:


ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqql6MzstZYh1TmWWv11q5O3pISj2ZFl9HgH1JLknLLx44+tXfJ7mIrKNxOOwxIxvcBF8PXSYvobFYEZjGIVCEAjrUzLiIxbyCoxVyle7Q+bqgZ8SeeM8wzytsY+dVGcBxF6N4JS+zVk5eMcV385gG3Y6ON3EG112n6d+SMXY0OEBIcO6x+PnUSGHrSgpBgX7Ks1r7xqFa7heJLLt2wWwkARptX7udSq05paBhcpB0pHtA1Rfz3K2B+ZVIpSDfki9UVKzT8JUmwW6NNzSgxUfQHGwnW7kj4jp4AT0VZk3ADw497M2G/12N0PPB5CnhHf7ovgy6nL1ikrygTKRFmNZISvAcywB9GVqNAVE+ZHDSCuURNsAInVzgYo9xgJDW8wUw2o8U77+xiFxgI5QSZX3Iq7YLMgeksaO4rBJEa54k8m5wEiEE1nUhLuJ0X/vh2xPff6SQ1BL/zkOhvJCACK6Vb15mDOeCSq54Cr7kvS46itMosi/uS66+PujOO+xt/2FWYepz6ZlN70bRly57Q06J+ZJoc9FfBCbCyYH7U/ASsmY095ywPsBo1XQ9PqhnN1/YOorJ068foQDNVpm146mUpILVxmq41Cj55YKHEazXGsdBIbXWhcrRf4G2fJLRcGUr9q8/lERo9oxRm5JFX6TCmj6kmiFqv+Ow9gI0x8GvaQ== [email protected]

Entry your distant host utilizing whichever methodology you might have out there.

After getting entry to your account on the distant server, you need to be sure the ~/.ssh listing exists. This command will create the listing if vital, or do nothing if it already exists:

Now, you'll be able to create or modify the authorized_keys file inside this listing. You may add the contents of your file to the top of the authorized_keys file, creating it if vital, utilizing this command:

  • echo public_key_string >> ~/.ssh/authorized_keys

Within the above command, substitute the public_key_string with the output from the cat ~/.ssh/ command that you simply executed in your native system. It ought to begin with ssh-rsa AAAA....

We are able to now try passwordless authentication with our Ubuntu server.

Step 3 — Authenticate to Ubuntu Server Utilizing SSH Keys

When you've got efficiently accomplished one of many procedures above, you need to be capable to log into the distant host with out the distant account's password.

The fundamental course of is identical:

If that is your first time connecting to this host (in case you used the final methodology above), you may even see one thing like this:


The authenticity of host ' (' cannot be established. ECDSA key fingerprint is fd:fd:d4:f9:77:fe:73:84:e1:55:00:advert:d6:6d:22:fe. Are you certain you need to proceed connecting (sure/no)? sure

Because of this your native laptop doesn't acknowledge the distant host. Kind "yes" after which press ENTER to proceed.

In case you didn't provide a passphrase in your personal key, you can be logged in instantly. In case you equipped a passphrase for the personal key while you created the important thing, you can be prompted to enter it now (notice that your keystrokes won't show within the terminal session for safety). After authenticating, a brand new shell session ought to open for you with the configured account on the Ubuntu server.

If key-based authentication was profitable, proceed on to discover ways to additional safe your system by disabling password authentication.

Step 4 — Disable Password Authentication in your Server

In case you have been capable of log into your account utilizing SSH with no password, you might have efficiently configured SSH-key-based authentication to your account. Nonetheless, your password-based authentication mechanism remains to be lively, which means that your server remains to be uncovered to brute-force assaults.

Earlier than finishing the steps on this part, just remember to both have SSH-key-based authentication configured for the foundation account on this server, or ideally, that you've got SSH-key-based authentication configured for a non-root account on this server with sudo privileges. This step will lock down password-based logins, so guaranteeing that you'll nonetheless be capable to get administrative entry is essential.

As soon as you have confirmed that your distant account has administrative privileges, log into your distant server with SSH keys, both as root or with an account with sudo privileges. Then, open up the SSH daemon's configuration file:

  • sudo nano /and so forth/ssh/sshd_config

Contained in the file, seek for a directive known as PasswordAuthentication. This can be commented out. Uncomment the road and set the worth to "no". This may disable your skill to log in by way of SSH utilizing account passwords:

/and so forth/ssh/sshd_config

PasswordAuthentication no

Save and shut the file if you find yourself completed by urgent CTRL + X, then Y to verify saving the file, and eventually ENTER to exit nano. To truly implement these modifications, we have to restart the sshd service:

  • sudo systemctl restart ssh

As a precaution, open up a brand new terminal window and check that the SSH service is functioning appropriately earlier than closing this session:

After getting verified your SSH service, you'll be able to safely shut all present server periods.

The SSH daemon in your Ubuntu server now solely responds to SSH keys. Password-based authentication has efficiently been disabled.


It's best to now have SSH-key-based authentication configured in your server, permitting you to register with out offering an account password.

If you would like to study extra about working with SSH, check out our SSH Necessities Information.

Learn how to Set up WordPress in VPS server LAMP

Previous article

10 Highly effective All-in-One iOS Cell App Templates

Next article

You may also like


Leave a Reply

More in Linux