Lion Cipher Lab
Set up SSH key authentication (and disable password login) on a server you own
- Identity & Access Management
- Beginner
- ~45-60 min
- Free · no account required
Why it matters
Almost every server on the internet is administered remotely -- nobody drives to a data center to type on it. The standard way to reach one and control it is SSH (the Secure Shell): an encrypted connection from your computer to a remote machine's command line. And the single most attacked door on the whole internet is SSH secured only by a password. Automated bots hammer exposed SSH servers around the clock, trying millions of username-and-password guesses, and every reused or weak password is one they eventually get. The fix that professionals reach for first is not a stronger password -- it…
What you'll learn
- what SSH is and why remote logins must be encrypted
- what a public/private key pair is, in plain terms, and why keys beat passwords
- generating a modern key pair with ssh-keygen (ed25519, with a passphrase)
- protecting the PRIVATE key and knowing it must never leave your machine
- installing your PUBLIC key on a server with ssh-copy-id (the authorized_keys file)
- logging in with your key and confirming it worked before changing anything
- safely editing the SSH server config (sshd_config) with a backup and a rescue session
- disabling password authentication so guessing attacks cannot work
- disabling direct root login to shrink what an attacker can target
- restarting sshd and TESTING the hardening without locking yourself out
Steps in this lab
- First: get a server you OWN, and understand the one safety rule
- Meet SSH, and open a terminal on YOUR computer
- Understand what a key pair is, and why keys beat passwords
- Generate your key pair with ssh-keygen
- Install your PUBLIC key on the server with ssh-copy-id
- Log in with your key and PROVE it works before changing anything
- Open your rescue session, back up sshd_config, and prepare to harden
- Disable password login and root login in sshd_config
- Apply the change, then TEST the hardening from a fresh terminal
- Protect the private key, make it a habit, and where to go next