ไทย
Currently, remote connectivity via SSH (Secure Shell) remains a critical standard because it ensures secure data transmission, free from eavesdropping or man-in-the-middle risks. However, if you continue to use traditional SSH with username and password authentication, significant security issues persist. This is why SSH keys may be a better alternative.
What is SSH and what are the limitations of password-based login?
SSH, or Secure Shell, is a network protocol designed to allow system administrators, developers, and general users to access remote machines (servers) through an encrypted connection. The advantages of SSH include protecting data from eavesdropping, reducing vulnerabilities to man-in-the-middle attacks, and being easy to use via terminal or client programs such as PuTTY.
However, the traditional method of identity verification has several weaknesses tied to the vulnerabilities of passwords. Using passwords exposes the system to higher risks when users set passwords that are too simple or reuse them across multiple systems. This issue is not merely inconvenient but can also create vulnerabilities within the system. Additionally, brute-force attacks can be easily carried out without proper protection.
What is an SSH Key and How Does It Work?
Creating Key Pairs
An SSH key is considered an asymmetric cryptography authentication system, consisting of a public key and a private key. Users create a pair of keys, where the private key is confidential and stored only on the user’s device, while the public key can be safely shared or distributed without compromising security. When connecting via SSH, the client uses the private key to decrypt messages sent by the server, and if decryption is successful The server will allow access to the system without requiring a password.
Safety Advantages
Using an SSH key offers a much higher level of security compared to passwords, as this system does not rely on information that needs to be typed or transmitted directly over the network. Additionally, users can set a passphrase to add an extra layer of protection to their private key. Even if the key is compromised, it cannot be used without the correct passphrase.
Types of SSH Keys Commonly Used
RSA
RSA is one of the earliest algorithms used to generate SSH keys. Its security depends on the specified key size, such as 2048-bit or 4096-bit. The larger the key size, the more difficult it is to decrypt, but this comes at the cost of higher processing resource requirements.
ECDSA
ECDSA (Elliptic Curve Digital Signature Algorithm) utilizes the principles of elliptic curves, which enable the generation of smaller keys and significantly higher efficiency. It operates faster and requires less CPU usage compared to RSA.
Ed25519
Ed25519 is a new-generation algorithm designed to strike a balance between convenience, security, and efficiency. It is popular among modern security experts.
How to Create an SSH Key on Various Operating Systems
On Linux and macOS, users can conveniently generate SSH keys using the ssh-keygen command, which supports algorithm options such as -t ed25519. Users can also choose the file storage location or add a passphrase as desired. For Windows users, the main alternatives are PuTTYgen or WSL (Windows Subsystem for Linux). Although the usage steps may differ slightly, the basic process of generating key pairs remains the same across all systems.
Installing a public key on the server
Once the public key has been successfully generated, the next step is to copy the .pub file to the server and to ~/.ssh/authorized_keys. This can be easily done using the command ssh-copy-id, or you can simply copy and paste the text into the authorized_keys file. Additionally, it is recommended to set the permission of the .ssh folder to 700 and the authorized_keys file to 600 for Unix systems to ensure security.
Configuring SSH Host Settings for Convenient Connection
To enhance convenience when using SSH, you can customize the ~/.ssh/config file by creating a section for each server. For example, you can set host aliases, specify key files, ports, or enable agent forwarding. Once these settings are configured, connecting to a server becomes as simple as using ssh alias instead of entering lengthy information.
Advantages of SSH Keys in Real-World Use
In addition to providing encryption security, using SSH keys also helps large systems manage users more efficiently through automated tools or CI/CD systems that seamlessly connect to various servers. Furthermore, system administrators can manage access with granular control, such as assigning unique keys to individual machines or revoking certain keys immediately when a staff member is replaced.
SSH Keys also help reduce the burden of password storage, recycling, and sharing login information between teams.
SSH Key Security Guidelines
To mitigate risks associated with storing private keys, appropriate file permissions should be established and avoid storing keys in easily accessible locations. A passphrase should be used for each key set, and organizations should implement a regular key rotation policy, such as every 6 months or once a year, replacing each set. Reusing the same key throughout the system’s lifespan is prohibited. Additionally, if there is a change in staff or team members, the permissions for the old key should be revoked immediately to ensure maximum security.
SSH Key Management Tool for Organizations
Medium to large organizations that need to manage a large number of keys may opt for management tools such as HashiCorp Vault, AWS Secrets Manager, or OSS tools like Teleport. These solutions enable key distribution to specific machines, logging of key usage, and support for key revocation or automated tasks such as onboarding/offboarding.
Disadvantages of Using SSH Keys
Although SSH keys are more secure and flexible than passwords, they still have certain limitations. For example, if a user loses their private key without a backup, they may no longer be able to access the system. Additionally, if the key is compromised without a passphrase or if file permissions are not properly set, unauthorized individuals could easily gain access to the system.
Additionally, beginners may find the setup process quite complicated, especially those who are not familiar with using commands through the terminal or Unix systems.
Summary:
An SSH key is a tool that enhances the security of remote connections via SSH. It uses asymmetric encryption to make authentication more secure than traditional passwords, significantly reducing the risk of eavesdropping, brute-force attacks, and issues with weak or duplicate passwords.
Additionally, SSH keys are ideal for systems that require flexibility and automation, such as DevOps, CI/CD, or environments with multiple administrators. This is because they allow for granular access control, which can be set by user or device, and access can be revoked immediately if necessary.
However, using SSH keys also has limitations, such as the initial complexity and the need for strict maintenance of the private key.
