PVE SSH Key Based Authentication

From WikiMLT
Prox­mox

In this ar­ti­cle we are go­ing to set­up an SSH key based au­then­ti­ca­tion for the PVE host. Let's as­sume we are on a ter­mi­nal win­dow (or con­sole) at a re­mote in­stance and we want to log-in se­cure­ly to the PVE host with­out en­ter our pass­word.

The first step is to gen­er­ate the key pair. For this pur­pose we will cre­ate a sep­a­rate pri­vate di­rec­to­ry where the key pair will be stored and then will gen­er­ate the key in­side this di­rec­to­ry. Note the -N '' with­in the fol­low­ing com­mand means emp­ty passphrase, but it is mat­ter of choice if you want to cre­ate it.

mkdir -p -m 700 ~/.ssh/pve-lan/
ssh-keygen -t rsa -b 4096 -C 'user@metalevel.tech' -f ~/.ssh/pve-lan/pve_id_rsa -q -N ''

The sec­ond step is to copy the pub­lic key to the PVE host. In the fol­low­ing com­mand 192.168.1.200 is the LAN IP ad­dress of the PVE host. You will need to en­ter you root pass­word in or­der to copy the .pub key over SSH.

ssh-copy-id -i ~/.ssh/pve-lan/pve_id_rsa.pub root@192.168.1.200

The third step is to add an en­try in your ~/.ssh/config in or­der to al­low easy CLI syn­tax. If the con­fig file doesn't ex­ist be­fore we should change its per­mis­sions to oc­tal 600, oth­er­wise the SSH client will throw an er­ror.

nano ~/.ssh/config && chmod 600 ~/.ssh/config

Host pve
    HostName 192.168.1.200
    IdentityFile ~/.ssh/pve-lan/pve_id_rsa
    User root
    Port 22

The Host en­try pve is an alias to the Host­Name, you can change it to more de­scrip­tive one. Once the con­fig­u­ra­tion file is saved, you will be able to con­nect to your PVE host by the fol­low­ing com­mand.

ssh pve

Linux pve 5.13.19-2-pve #1 SMP PVE 5.13.19-4 (Mon, 29 Nov 2021 12:10:09 +0100) x86_64...
Last login: Sat Mar 19 09:51:25 2022 from 192.168.1.110
root@pve:~#

Fi­nal­ly, once the SSH key based au­then­ti­ca­tion works, you can dis­able the SSH pass­word based au­then­ti­ca­tion at the PVE side. 

nano /etc/ssh/sshd_config

PasswordAuthentication no
PermitEmptyPasswords yes


Retrieved from "https://wiki.metalevel.tech/index.php?title=PVE_SSH_Key_Based_Authentication&oldid=27463"