Configure the SSH server and client

3min
Perform the following tasks to configure the SSH server and client:
1 | Extract the SSH client public key from the zip file
1
Log in to the SSH server machine as the user you plan to connect with from the SSH client machine.
2
Open a terminal session and go to the location of the SSH client public key zip file exported from the .
3
Run the following command to extract the SSH client public key from the zip file, modifying the file name to match the actual name of your file.
Shell
unzip archive171924.zip
unzip archive171924.zip
﻿
You should see the following output:
Text
Archive:  archive171924.zip
 extracting: SSH.pub
Archive:  archive171924.zip
 extracting: SSH.pub
﻿
The SSH.pub file is in DER format, meaning the public key is binary encoded. 
The next section uses OpenSSL to convert the SSH.pub file from DER to PEM format. PEM is a method of encoding binary data as a string (also known as ASCII armor).
2 | Convert the SSH client public key file from DER to PEM format
1
Run the following OpenSSL command to convert the public key exported from the  in DER format to PEM format (as required for the ssh-keygen command in the next subsection):
Shell
openssl rsa -inform DER -outform PEM -in SSH.pub -out SSH_pubkey.pem -pubin
openssl rsa -inform DER -outform PEM -in SSH.pub -out SSH_pubkey.pem -pubin
﻿
3 | Configure the SSH client public key on the SSH server and disable non-key-based modes of authentication
1
SSH requires a specific format for the public keys used within an SSH session. Run the following ssh-keygen command to convert the SSH_pubkey.pem file  from the previous command to the required SSH public key format and add it to the ~/.ssh/authorized_keys file:
Shell
ssh-keygen -f SSH_pubkey.pem -i -m PKCS8 >> ~/.ssh/authorized_keys
ssh-keygen -f SSH_pubkey.pem -i -m PKCS8 >> ~/.ssh/authorized_keys
﻿
2
Run the following command to open the SSH daemon configuration file:
Editing this file requires sudo privileges.
Shell
sudo vim /etc/ssh/sshd_config
sudo vim /etc/ssh/sshd_config
﻿
3
Inside the file, confirm the following directive is present:
Text
PubkeyAuthentication yes
PubkeyAuthentication yes
﻿
4
Optionally, you can also set the following directives to make the SSH daemon only respond to SSH keys:
Text
PasswordAuthentication no
ChallengeResponseAuthentication no
PasswordAuthentication no
ChallengeResponseAuthentication no
﻿
5
Save and close the file when finished. To implement these changes, restart the SSH service.

On Ubuntu or Debian machines, run the following command:
Shell
sudo systemctl restart sshd
sudo systemctl restart sshd
﻿
On CentOS/Fedora machines, run the following command:
Shell
sudo service sshd restart
sudo service sshd restart
﻿
﻿
Updated 03 Dec 2024
Did this page help you?
Configure SSH Key Offloading
Test the SSH connection