| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| howto:setup-sscs-linux-account-public-keys [2025/07/17 18:32] – [How to: Disable SSH Password Authentication] jnilsson | howto:setup-sscs-linux-account-public-keys [2026/08/03 18:25] (current) – dfiorell |
|---|
| ====== How to: setup SSCS account with SSH public-key authentication ====== | ====== How to: setup SocIT account with SSH public-key authentication ====== |
| |
| On linux servers, it is recommended to use public-key authentication rather than password authentication for SSH. This is especially true for when port 22 or SSH will be open to off-campus access through the UCI border firewall. | On linux servers, it is recommended to use public-key authentication rather than password authentication for SSH. This is especially true for when port 22 or SSH will be open to off-campus access through the UCI border firewall. |
| * [[https://www.ssh.com/academy/ssh/public-key-authentication|General info about SSH Public Key Authentication]] | * [[https://www.ssh.com/academy/ssh/public-key-authentication|General info about SSH Public Key Authentication]] |
| |
| ===== One-stop script to create the sscs account ===== | ===== One-stop script to create the socit user account ===== |
| |
| You can simply copy and paste the below code to download a script that we've set up for this purpose and execute it with sudo: | You can simply copy and paste the below code to download a script that we've set up for this purpose and execute it with sudo: |
| |
| <code> | <code> |
| curl -O -L https://sites.socsci.uci.edu/~jnilsson/sscs/setup-sscs-account.sh | curl -O -L https://sites.socsci.uci.edu/~jnilsson/sscs/setup-socit-account.sh |
| chmod +x ./setup-sscs-account.sh | chmod +x ./setup-socit-account.sh |
| sudo ./setup-sscs-account.sh | sudo ./setup-socit-account.sh |
| </code> | </code> |
| |
| Or if you prefer to run commands yourself, these are the equivalent commands: | Or if you prefer to run commands yourself, these are the equivalent commands: |
| <file> | <file> |
| SSCS_HOME=/home/sscs | SOCIT_HOME=/home/socit |
| sudo useradd -c "Computing Services" -m -d $SSCS_HOME -s /bin/bash sscs | sudo useradd -c "Computing Services" -m -d $SOCIT_HOME -s /bin/bash socit |
| echo "sscs ALL=(ALL) ALL" | sudo tee /etc/sudoers.d/sscs > /dev/null | echo "socit ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/socit > /dev/null |
| sudo mkdir -p $SSCS_HOME/.ssh | sudo mkdir -p $SOCIT_HOME/.ssh |
| sudo chmod 700 $SSCS_HOME/.ssh | sudo chmod 700 $SOCIT_HOME/.ssh |
| sudo touch $SSCS_HOME/.ssh/authorized_keys | sudo touch $SOCIT_HOME/.ssh/authorized_keys |
| sudo chmod 600 $SSCS_HOME/.ssh/authorized_keys | sudo chmod 600 $SOCIT_HOME/.ssh/authorized_keys |
| sudo chown -R sscs:sscs $SSCS_HOME/.ssh | sudo chown -R socit:socit $SOCIT_HOME/.ssh |
| echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWfC91AllbEn9VYT9a0838A/55rWtrSY/dm48fedc38 jnilsson@storgy.local" | sudo tee -a $SSCS_HOME/.ssh/authorized_keys | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWfC91AllbEn9VYT9a0838A/55rWtrSY/dm48fedc38 jnilsson@storgy.local" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDoygQr0UQLtpguLWJYiEBZWXUFEkUXVacE6sBZtn/6Z jnilsson@devjpn" | sudo tee -a $SSCS_HOME/.ssh/authorized_keys | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDoygQr0UQLtpguLWJYiEBZWXUFEkUXVacE6sBZtn/6Z jnilsson@devjpn" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH3jg7avVgdyx1jltUp9nJ02DOE9XH3hfcGBQI6KrVs sscs@gunship" | sudo tee -a $SSCS_HOME/.ssh/authorized_keys | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH3jg7avVgdyx1jltUp9nJ02DOE9XH3hfcGBQI6KrVs sscs-hyen@gunship" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqAc8VSY9DFEzzumkn1d2S1ytpYOWHSJkbOWN1HjFQR sscs@crateria" | sudo tee -a $SSCS_HOME/.ssh/authorized_keys | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqAc8VSY9DFEzzumkn1d2S1ytpYOWHSJkbOWN1HjFQR sscs-hyen@crateria" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4u9RrufB93/AS2lsBVet4+U5rizO8noDKTSHhcLmli justip6@Zaire" | sudo tee -a $SSCS_HOME/.ssh/authorized_keys | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGs3wce3UKRBTVLzpSi7/TR8odzoUlwbA3dubzssJ9V justip6@zaire" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIErG9uQN2VUNqIjNowRw1J18T8dORd2HhJi3zl9Vs7+t justip6@zeon.ss2k.uci.edu" | sudo tee -a $SSCS_HOME/.ssh/authorized_keys | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIErG9uQN2VUNqIjNowRw1J18T8dORd2HhJi3zl9Vs7+t justip6@zeon.ss2k.uci.edu" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMtdfuw5hq6naiRnVCAKEUhpYTazWC5WE7rxCcXLN/cU lhtran@bahamut-zero.local" | sudo tee -a $SSCS_HOME/.ssh/authorized_keys | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMtdfuw5hq6naiRnVCAKEUhpYTazWC5WE7rxCcXLN/cU lhtran@bahamut-zero.local" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK5DC1gTDzQtcNhvoCkgUzsf7ntvP/Ldac3EAgZ9Y/yc soceco\lmonzon@TECDSHHS9WX3" | sudo tee -a $SSCS_HOME/.ssh/authorized_keys | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK5DC1gTDzQtcNhvoCkgUzsf7ntvP/Ldac3EAgZ9Y/yc soceco\lmonzon@TECDSHHS9WX3" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| | echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICvbrrKXsNEBOWjQXQhenljmA7asPmBsmK/keoM2F5m0 dfiorell@ark.ss.uci.edu" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys |
| </file> | </file> |
| |
| If you don't want the home directory to be /home/sscs, you can easily set your own SSCS_HOME variable to whatever location you choose and then copy/paste the rest of the commands. Or if you download the ''setup-sscs-account.sh'' script and you want to change the location of the sscs account home directory, modify the script accordingly before executing it. | If you don't want the home directory to be /home/socit, you can easily set your own SOCIT_HOME variable to whatever location you choose and then copy/paste the rest of the commands. Or if you download the ''setup-socit-account.sh'' script and you want to change the location of the socit account home directory, modify the script accordingly before executing it. |
| |
| |
| ===== How to: Disable SSH Password Authentication ====== | ===== How to: Disable SSH Password Authentication ====== |
| |
| Disabling Password Authentication is generally as simple as setting the option ''PasswordAuthentication no'' in the /etc/ssh/sshd_config file and then restarting the sshd service. | After you have set up SSH keys for all your user accounts on a server that has port 22 open to the world, it is recommended to disable password authentication for increased security. |
| |
| However, we've discovered that some linux distributions add another configuration file **/etc/ssh/sshd_config.d/50-cloud-init.conf** which contains ''PasswordAuthentication yes'' to force password authentication to be enabled. | Disabling Password Authentication is generally as simple as setting the option ''PasswordAuthentication no'' in the /etc/ssh/sshd_config file and then restarting the sshd service. However, we've discovered that some linux distributions add another configuration file **/etc/ssh/sshd_config.d/50-cloud-init.conf** which contains ''PasswordAuthentication yes'' to force password authentication to be enabled. |
| |
| Therefore, the easiest way to universally disable password authentication is to create a new file that sorts lexicographically before any other files that might be created in there, such as **00-disable-password-auth.conf**: | Therefore, the easiest way to universally disable password authentication is to create a new file that sorts lexicographically before any other files that might be created in there, such as **00-disable-password-auth.conf**: |
