Part 2: Connect from your computer

10. Lock SSH: keys only#

What you'll do: turn off password logins, so only your devices with keys can get in. Password-guessing attacks become useless. Time: 10 minutes.

flowchart LR
  A["Before:<br/>password OR key"] --> B["After:<br/>key only"]
  X["Stranger guessing<br/>passwords"] -. "blocked" .-x B

Stop: first check every device you need already logs in with a key

ssh homeserver from your Mac (and PC, and phone) must log in without asking for the server password. If one doesn't, finish Chapter 7, 8 or 9 for it first. Otherwise that device gets locked out.

Step 1: Keep a safety window open#

Open two terminal windows on your Mac or PC and log in to the server in both (ssh homeserver). Do the work in window 1 and don't close window 2. It stays logged in even if something goes wrong.

Step 2: Create the lock file#

Type on: the server (window 1)

sudo nano /etc/ssh/sshd_config.d/99-lockdown.conf

Paste exactly:

File: /etc/ssh/sshd_config.d/99-lockdown.conf

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

Save and exit.

Step 3: Check for typos, then apply#

Type on: the server

sudo sshd -t

No output = no errors. If it prints an error, open the file again and fix it. Don't continue until it's silent.

Type on: the server

sudo systemctl reload ssh

Step 4: Test in a NEW window#

Open a third terminal window and connect:

Type on: your Mac or PC

ssh homeserver

It should log in as before. Now prove passwords are refused:

Type on: your Mac or PC

ssh -o PubkeyAuthentication=no alex@homeserver.local

It should say Permission denied (publickey). That's what you want.

New window can't log in at all?

Use the safety window (window 2) to undo: sudo rm /etc/ssh/sshd_config.d/99-lockdown.conf and then sudo systemctl reload ssh. Fix your key, then try again.

Adding a new device later#

Passwords no longer work, so add a new device's public key from a device that already works: log in with it and paste the new key into ~/.ssh/authorized_keys, as in Chapter 9, step 3.

Lost or stolen device#

Log in from another device, open ~/.ssh/authorized_keys with nano, and delete that device's line. The comment at the end of each line (e.g. iphone-homeserver) tells you which line belongs to which device.

Done when:

Your devices log in with keys
The password test says Permission denied (publickey)

Next: 11. Automatic updates