Login with SSH keys¶

Difficulty: Easy Tested v0.18.5.3

SSH keys are much stronger than passwords and can't be brute-forced. With keys in place, you can turn password logins off completely.

Create a key on your regular computer¶

Skip this if you already have one (ls ~/.ssh/id_ed25519.pub).

ssh-keygen -t ed25519 -C "monerobox"

Give it a passphrase. Your OS keychain or ssh-agent can remember it.

Copy it to the node¶

Linux / macOSWindows (PowerShell)

ssh-copy-id nodeadmin@NODE_IP

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh nodeadmin@NODE_IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Log out, then log in again with ssh nodeadmin@NODE_IP. It should ask for your key passphrase (or nothing), not Password [A].

Turn off password logins¶

Danger

Only do this after you've confirmed key login works, and keep your current session open until you've tested a new one. Losing your key means you need a monitor and keyboard to get back in.

sudo nano /etc/ssh/sshd_config.d/99-monerobox.conf

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no

sudo sshd -t && sudo systemctl reload ssh

Open a new terminal and test ssh nodeadmin@NODE_IP. Then try logging in with a password from another machine. It should be refused.

Password [A] is still needed for sudo.