TDCTF Academy Logo TDCTF ACADEMY
@farishhz

SSH Key Management

Cheat sheet lengkap untuk setup, manajemen, dan hardening SSH key authentication.

Password vs Key: Perbandingan Keamanan

Aspek Password Auth Key Auth
Kekuatan Tergantung user (sering lemah) 256-bit+ (secara matematis kuat)
Brute-force Rentan (bot terus mencoba) Praktis tidak mungkin
Phishing Bisa dicuri Tidak bisa (tanpa private key)
Kenyamanan Harus diketik setiap login Auto-login (dengan agent)
Revoke Ganti password Hapus public key dari authorized_keys
Multi-server Password berbeda tiap server Satu key untuk banyak server

Kesimpulan: Key authentication lebih aman dan nyaman. Nonaktifkan password login SSH setelah setup key.

️ Generate SSH Key Pair

Cara Modern - Ed25519 (Rekomendasi)

# Generate key Ed25519 (default modern)
ssh-keygen -t ed25519 -C "[email protected]"

# Dengan custom filename
ssh-keygen -t ed25519 -f ~/.ssh/id_github -C "github-key"

Cara Legacy - RSA (jika perlu kompatibilitas)

# RSA 4096 bit (untuk server tua)
ssh-keygen -t rsa -b 4096 -C "[email protected]"

Perbandingan Key Types

Type Bit Keamanan Kecepatan Kompatibilitas
Ed25519 256 🟢 Excellent 🟢 Sangat cepat 🟡 OpenSSH 6.5+
RSA 4096 🟢 Baik 🔴 Lambat 🟢 Universal
ECDSA 256 🟡 Baik (kurva NIST) 🟢 Cepat 🟡 OpenSSH 5.7+
DSA 1024 🔴 Tidak aman 🟡 Sedang 🟢 Legacy

Rekomendasi: Gunakan Ed25519 untuk semua sistem baru. Gunakan RSA 4096 hanya jika perlu kompatibilitas dengan server lawas (OpenSSH < 6.5).

Proses Generate (Interactive)

ssh-keygen -t ed25519

Output:

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/user/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_ed25519
Your public key has been saved in /home/user/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx [email protected]

Hasil:

  • ~/.ssh/id_ed25519 - private key (RAHASIA, jangan dibagikan!)
  • ~/.ssh/id_ed25519.pub - public key (dapat dibagikan)

Copy Public Key ke Server

Metode 1: ssh-copy-id (Mudah)

# Copy public key ke server
ssh-copy-id user@server-ip

# Jika pakai port non-default
ssh-copy-id -p 2222 user@server-ip

# Jika pakai key spesifik
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server-ip

Metode 2: Manual

# Copy public key ke server via SSH (password login)
cat ~/.ssh/id_ed25519.pub | ssh user@server-ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Atau jika belum ada akses SSH sama sekali (via console/out-of-band): 

# Di server, edit authorized_keys
echo "ssh-ed25519 AAAAC3... [email protected]" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh

Multiple Keys - Konfigurasi ~/.ssh/config

Jika punya banyak key untuk server berbeda (GitHub, server kerja, server pribadi), gunakan file konfigurasi.

~/.ssh/config
# Default (jika tidak cocok dengan Host lain)
Host *
    IdentityFile ~/.ssh/id_ed25519
    AddKeysToAgent yes
    ServerAliveInterval 60

# GitHub (personal)
Host github.com
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_github
    IdentitiesOnly yes

# GitHub (kerja)
Host github-kerja
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_github_kerja
    IdentitiesOnly yes

# Server pribadi
Host myserver
    HostName 192.168.1.100
    User labkom
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 30

# Server VPS
Host vps-*
    HostName %h.example.com
    User root
    IdentityFile ~/.ssh/id_rsa_vps
    Port 2222

Cara Pakai

# Tanpa config (harus panjang)
ssh -i ~/.ssh/id_github -p 2222 [email protected]

# Dengan config (pendek & bersih)
ssh myserver
ssh github-kerja
ssh vps-01

SSH Agent - Caching Passphrase

Jika private key Anda diberi passphrase (sangat disarankan!), SSH agent menyimpan passphrase sementara agar tidak perlu mengetik ulang.

Start SSH Agent

# Start agent di background
eval "$(ssh-agent -s)"

# Output: Agent pid 12345

Add Key ke Agent

# Tambah key default
ssh-add

# Tambah key spesifik
ssh-add ~/.ssh/id_github

# Tambah dengan passphrase (akan diminta sekali)
Enter passphrase for /home/user/.ssh/id_ed25519:
Identity added: /home/user/.ssh/id_ed25519 ([email protected])

# List keys di agent
ssh-add -l

# List dengan fingerprint
ssh-add -L

# Hapus semua keys
ssh-add -D

Auto-Start Agent di Shell

Tambahkan ke ~/.bashrc atau ~/.zshrc:

~/.bashrc
# Auto-start SSH agent
if [ -z "$SSH_AUTH_SOCK" ]; then
    eval "$(ssh-agent -s)" > /dev/null
    ssh-add ~/.ssh/id_ed25519 2>/dev/null
fi

macOS: Keychain Integration

# macOS menyimpan passphrase di Keychain
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

# Di ~/.ssh/config
Host *
    UseKeychain yes
    AddKeysToAgent yes

Passphrase Management

Set / Ubah Passphrase

# Set passphrase di key yang belum ada
ssh-keygen -p -f ~/.ssh/id_ed25519

# Ubah passphrase
ssh-keygen -p -f ~/.ssh/id_ed25519

# Hapus passphrase (tidak disarankan)
ssh-keygen -p -N "" -f ~/.ssh/id_ed25519

Passphrase vs No Passphrase

Passphrase Keamanan Kenyamanan
Ya (disarankan) Key aman meski file dicuri Ketik sekali, agent cache sisanya
Tidak Jika file dicuri, server bobol Auto-login tanpa interupsi

Rekomendasi: Gunakan passphrase + SSH agent. Aman dan nyaman.

️ Hardening sshd_config

Setelah key auth berfungsi, hardening server SSH.

Lokasi: /etc/ssh/sshd_config

/etc/ssh/sshd_config
# NONAKTIFKAN password login (HARUS setelah key berfungsi!)
PasswordAuthentication no

# Nonaktifkan root login via SSH
PermitRootLogin prohibit-password
# Atau jika root tidak boleh SSH sama sekali:
# PermitRootLogin no

# Ubah port (hindari scan bot)
Port 2222

# Batasi user yang boleh SSH
AllowUsers labkom admin deploy

# Batasi group
AllowGroups ssh-users

# Hanya gunakan key auth
PubkeyAuthentication yes
AuthenticationMethods publickey

# Versi protokol
Protocol 2

# Logging detail
LogLevel VERBOSE

# Timeout idle
ClientAliveInterval 300
ClientAliveCountMax 2

# Nonaktifkan X11 forwarding (jika tidak perlu)
X11Forwarding no

# Nonaktifkan agent forwarding
AllowAgentForwarding no

# Maks login attempts
MaxAuthTries 3
MaxSessions 5

Apply Konfigurasi

# Validasi konfigurasi
sudo sshd -t

# Restart SSH
sudo systemctl restart sshd

# JANGAN TUTUP session SSH saat ini!
# Buka terminal baru untuk test login

⚠️ Peringatan: Selalu test login dengan key di terminal terpisah SEBELUM logout dari session saat ini. Jika ada error, Anda bisa memperbaiki tanpa kehilangan akses.

Permission Penting

Permission yang salah adalah penyebab utama SSH key tidak bekerja.

# Direktori .ssh
chmod 700 ~/.ssh           # rwx------

# Private key (RAHASIA)
chmod 600 ~/.ssh/id_ed25519       # rw-------
chmod 600 ~/.ssh/id_rsa

# Public key (aman dibagikan)
chmod 644 ~/.ssh/id_ed25519.pub   # rw-r--r--

# Authorized keys
chmod 600 ~/.ssh/authorized_keys  # rw-------

# Config file
chmod 600 ~/.ssh/config           # rw-------

Cepat:

chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519 ~/.ssh/authorized_keys ~/.ssh/config && chmod 644 ~/.ssh/*.pub

Troubleshooting

Permission denied (publickey)

Penyebab umum:

  1. Public key tidak ada di ~/.ssh/authorized_keys server
  2. Permission salah (lihat bagian permission)
  3. Private key tidak cocok dengan public key

Debug:

# SSH verbose (level 1-3)
ssh -v user@server
ssh -vv user@server
ssh -vvv user@server

Cari baris seperti:

debug1: Authentications that can continue: publickey
debug1: Offering public key: /home/user/.ssh/id_ed25519
debug1: Authentication succeeded (publickey).

Server refused our key

# Cek authorized_keys di server
cat ~/.ssh/authorized_keys

# Cek permission
ls -la ~/.ssh/
ls -la ~/.ssh/authorized_keys

# Cek log server
sudo journalctl -u sshd -n 20
# atau
sudo tail -f /var/log/auth.log

Key Tiba-tiba Tidak Bekerja

# Cek apakah key masih terdaftar di agent
ssh-add -l

# Jika tidak ada, tambah lagi
ssh-add ~/.ssh/id_ed25519

# Cek koneksi agent
echo $SSH_AUTH_SOCK

WARNING: UNPROTECTED PRIVATE KEY FILE!

Permission private key terlalu terbuka:

chmod 600 ~/.ssh/id_ed25519

Revoke Akses SSH

Mencabut akses user dari server:

# Hapus public key dari authorized_keys
# Edit file:
nano ~/.ssh/authorized_keys
# Hapus baris public key yang tidak diinginkan
# Simpan

# Atau jika ingin revoke semua akses user:
sudo userdel -r username

Jika ingin ban total IP tertentu:

# Tambahkan ke /etc/hosts.deny
echo "sshd: 192.168.1.200" >> /etc/hosts.deny

Jump Host / Bastion

Jika harus SSH ke server internal melalui bastion host (jump server).

ProxyJump (Metode Modern - OpenSSH 7.3+)

~/.ssh/config
Host internal-server
    HostName 10.0.1.50
    User labkom
    ProxyJump bastion.example.com
    IdentityFile ~/.ssh/id_ed25519

Host bastion
    HostName bastion.example.com
    User admin
    IdentityFile ~/.ssh/id_ed25519
# Cukup satu command
ssh internal-server

ProxyCommand (Metode Legacy)

ssh -o ProxyCommand="ssh -W %h:%p bastion.example.com" user@internal-server

Atau di config:

Host internal-server
    HostName 10.0.1.50
    User labkom
    ProxyCommand ssh bastion -W %h:%p

SSH Tunnel (Port Forwarding)

Local Forwarding (-L)

Akses resource di server melalui localhost:

# Forward port server:3306 ke localhost:3306
ssh -L 3306:localhost:3306 user@server

# Forward port berbeda
ssh -L 8080:localhost:80 user@server
# Akses: http://vuln.cybersecurity.or.id -> server:80

Remote Forwarding (-R)

Ekspose port lokal ke server remote:

# Forward localhost:3000 ke server:8000
ssh -R 8000:localhost:3000 user@server
# Di server, akses: http://localhost:8000

Dynamic Forwarding (-D - SOCKS Proxy)

# Buat SOCKS proxy di port 1080
ssh -D 1080 user@server

# Setting browser:
# SOCKS5 proxy: localhost:1080
# Semua traffic browser melalui server SSH

Auto Tunnel dengan Config

~/.ssh/config
Host tunnel
    HostName server
    User labkom
    LocalForward 3306 localhost:3306    # MySQL
    LocalForward 8080 localhost:80      # Web
    DynamicForward 1080                  # SOCKS
# Aktifkan semua tunnel
ssh tunnel

Ringkasan Perintah

Perintah Fungsi
ssh-keygen -t ed25519 Generate key pair Ed25519
ssh-keygen -t rsa -b 4096 Generate key pair RSA 4096
ssh-copy-id user@server Copy public key ke server
ssh -i ~/.ssh/key user@server SSH dengan key spesifik
ssh user@server -p 2222 SSH port non-default
ssh -vvv user@server Debug SSH connection
eval "$(ssh-agent -s)" Start SSH agent
ssh-add ~/.ssh/id_ed25519 Add key ke agent
ssh-add -l List keys di agent
ssh-keygen -p -f ~/.ssh/id_ed25519 Ubah passphrase
sudo sshd -t Validasi konfigurasi SSH
sudo systemctl restart sshd Restart SSH server
ssh -L 3306:localhost:3306 user@server Local port forwarding
ssh -D 1080 user@server Dynamic/SOCKS forwarding
ssh -J bastion user@internal Jump host (ProxyJump)

💡 Golden Rules SSH:

  1. Gunakan Ed25519 untuk key baru
  2. Selalu gunakan passphrase + SSH agent
  3. Setelah key berfungsi, nonaktifkan PasswordAuthentication no
  4. Cek permission: 600 untuk private key, 700 untuk ~/.ssh/
  5. Test login di terminal terpisah sebelum restart SSH
← Sebelumnya SQLite Quick Reference Selanjutnya → Setup SUDO_PASSWORD
PADA HALAMAN INI