> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the SSH server

> Step-by-step instructions to configure SSH server for public key authentication.

Perform the following steps to configure the SSH Client Public Key on the SSH Server and disable non-key-based modes of authentication:

<Steps>
  <Step>
    Log in to the SSH server machine as the root user.
  </Step>

  <Step>
    Open a terminal session and go to the location of the SSH client public key file that you exported from the KMES Series 3.
  </Step>

  <Step>
    Run the following OpenSSL command to convert the public key that was exported from the KMES Series 3 from DER format to PEM format (this is required for the **ssh-keygen** command in step 4):

    ```shell expandable lines wrap title="Shell" theme={null}
    openssl rsa -inform DER -outform PEM -in SSH.pub -out SSH_Client_Public.pem -pubin
    ```
  </Step>

  <Step>
    SSH requires a specific format for the public keys used within an SSH session. Run the following ssh-keygen command to convert the SSH\_Client\_Public.pem file that was output from the previous command to the required SSH public key format, and add it to the `~/.ssh/authorized_keys` file:

    ```shell expandable lines wrap title="Shell" theme={null}
    ssh-keygen -f SSH_Client_Public.pem -i -m PKCS8 >> ~/.ssh/authorized_keys
    ```
  </Step>

  <Step>
    Open the SSH daemon configuration file:

    ```shell expandable lines wrap title="Shell" theme={null}
    vim /etc/ssh/sshd_config
    ```
  </Step>

  <Step>
    Inside the file, make sure that the following directive is set:

    ```none expandable lines wrap title="None" theme={null}
    PubkeyAuthentication yes
    ```
  </Step>

  <Step>
    Optionally, you can also set the following directives to make the SSH daemon respond only to SSH keys:

    ```none expandable lines wrap title="None" theme={null}
    PasswordAuthentication no
    ChallengeResponseAuthentication no
    ```
  </Step>

  <Step>
    Save and close the file when finished. You must restart the SSH service to apply the changes.

    On Ubuntu or Debian machines, issue the following command:

    ```shell expandable lines wrap title="Shell" theme={null}
    sudo service ssh restart
    ```

    On CentOS/Fedora machines, issue the following command to start the **sshd** daemon:

    ```shell expandable lines wrap title="Shell" theme={null}
    sudo service sshd restart
    ```
  </Step>
</Steps>