How to Setup and Secure Linux SSH Logins to use Private PEM Keys

SSH logins are susceptible to brute force attacks. A thousand things can go wrong which could give someone unauthorized access to your server. The best way to secure your SSH login is to use Public/Private PEM keys. This is default login type for Amazon EC2 servers. Unfortunately Amazon’s interface only created a single account. This tutorial will show you how to setup additional PEM keys for other users.
Once you’ve logged into your server, do the following:

Step 1: New Account setup

Here we will create the new account, and add them to the sudoers group.

sudo adduser NewUser

1	sudo adduser NewUser

sudo su
passwd NewUser
visudo

Optional: Add the user to Sudoers

visudo #add this to the last line 1 NewUser ALL = (ALL) ALL

1 2 3

visudo #add this to the last line 1 NewUser   ALL = (ALL)    ALL

Step 2: Generate the Public/Private key files

Now we will create the public and private key files for NewUser. This tutorial assumes that the user is part of the ec2-users group. If not, please make sure to change the code where applicable.

su NewUser #Enter the password cd ~/ ssh-keygen -b 1024 -f NewUser -t dsa mkdir .ssh chmod 700 .ssh cat NewUser.pub >> .ssh/authorized_keys chmod 600 .ssh/authorized_keys chown NewUser .ssh chown NewUser .ssh/authorized_keys

1 2 3 4 5 6 7 8 9 10

su NewUser #Enter the password cd ~/ ssh-keygen -b 1024 -f NewUser -t dsa mkdir .ssh chmod 700 .ssh cat NewUser.pub >> .ssh/authorized_keys chmod 600 .ssh/authorized_keys chown NewUser .ssh chown NewUser .ssh/authorized_keys

Step 3: Download your private key

You will now have to download, or copy the contents of your private pem file. This should be called NewUser.pem.
If you are going to copy the contents of the file to a key file on your local system, just copy and paste the data into a new file.
Before using your key, make sure to change the permissions to 600.

chmod 600 NewUser.pem

1	chmod 600 NewUser.pem

Step 4: Test your SSH Login

Now let’s test our password-less login to make sure the private pem files are working.

ssh -i /path/to/file/NewUser.pem NewUser@YourDomain.com

1	ssh -i /path/to/file/NewUser.pem NewUser@YourDomain.com

That should do it! Hope you find this tutorial helpful. Feel free to ask any questions!