SocSci Computing Services Help Pages

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== How to: setup SocIT account with SSH public-key authentication ======

On linux servers, it is recommended to use public-key authentication rather than password authentication for SSH. This is especially true for when port 22 or SSH will be open to off-campus access through the UCI border firewall.

  * [[https://www.ssh.com/academy/ssh/public-key-authentication|General info about SSH Public Key Authentication]]

===== One-stop script to create the socit user account =====

You can simply copy and paste the below code to download a script that we've set up for this purpose and execute it with sudo:

<code>
curl -O -L https://sites.socsci.uci.edu/~jnilsson/sscs/setup-socit-account.sh
chmod +x ./setup-socit-account.sh
sudo ./setup-socit-account.sh
</code>

Or if you prefer to run commands yourself, these are the equivalent commands:
<file>
SOCIT_HOME=/home/socit
sudo useradd -c "Computing Services" -m -d $SOCIT_HOME -s /bin/bash socit
echo "socit    ALL=(ALL)  NOPASSWD: ALL" | sudo tee /etc/sudoers.d/socit > /dev/null
sudo mkdir -p $SOCIT_HOME/.ssh
sudo chmod 700 $SOCIT_HOME/.ssh
sudo touch $SOCIT_HOME/.ssh/authorized_keys
sudo chmod 600 $SOCIT_HOME/.ssh/authorized_keys
sudo chown -R socit:socit $SOCIT_HOME/.ssh
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWfC91AllbEn9VYT9a0838A/55rWtrSY/dm48fedc38 jnilsson@storgy.local" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDoygQr0UQLtpguLWJYiEBZWXUFEkUXVacE6sBZtn/6Z jnilsson@devjpn" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH3jg7avVgdyx1jltUp9nJ02DOE9XH3hfcGBQI6KrVs sscs@gunship" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqAc8VSY9DFEzzumkn1d2S1ytpYOWHSJkbOWN1HjFQR sscs@crateria" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4u9RrufB93/AS2lsBVet4+U5rizO8noDKTSHhcLmli justip6@Zaire" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIErG9uQN2VUNqIjNowRw1J18T8dORd2HhJi3zl9Vs7+t justip6@zeon.ss2k.uci.edu" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMtdfuw5hq6naiRnVCAKEUhpYTazWC5WE7rxCcXLN/cU lhtran@bahamut-zero.local" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK5DC1gTDzQtcNhvoCkgUzsf7ntvP/Ldac3EAgZ9Y/yc soceco\lmonzon@TECDSHHS9WX3" | sudo tee -a $SOCIT_HOME/.ssh/authorized_keys
</file>

If you don't want the home directory to be /home/socit, you can easily set your own SOCIT_HOME variable to whatever location you choose and then copy/paste the rest of the commands. Or if you download the ''setup-socit-account.sh'' script and you want to change the location of the socit account home directory, modify the script accordingly before executing it.


===== How to: Disable SSH Password Authentication ======

After you have set up SSH keys for all your user accounts on a server that has port 22 open to the world, it is recommended to disable password authentication for increased security.

Disabling Password Authentication is generally as simple as setting the option ''PasswordAuthentication no'' in the /etc/ssh/sshd_config file and then restarting the sshd service. However, we've discovered that some linux distributions add another configuration file **/etc/ssh/sshd_config.d/50-cloud-init.conf** which contains ''PasswordAuthentication yes'' to force password authentication to be enabled.

Therefore, the easiest way to universally disable password authentication is to create a new file that sorts lexicographically before any other files that might be created in there, such as **00-disable-password-auth.conf**:
<file>
PasswordAuthentication no
</file>

After setting the ''PasswordAuthentication'' option to ''no'' you must reload the sshd daemon to get this setting to take effect:

  * on Debian/Ubuntu:<code>
sudo systemctl reload ssh
</code>
  * on RHEL/Rocky:<code>
sudo systemctl reload sshd
</code>