VPS server: a regular user and key-only SSH

What you'll achieve

• have your own user, with administrator rights through sudo;
• log in with it using an SSH key;
• turn off direct root login and password login without locking yourself out.

Before you start

• You are logged into the server as root, with your SSH key (step D in VPS server: first login over SSH).
• Keep a root SSH session open the whole time you work on the settings. If you get something wrong, you fix it from there. Run your tests from a new window.
• In the examples, the new user is called ana, and 203.0.113.7 is the server's IP.

The steps

A. Create the user

1. Ubuntu and Debian:

   adduser ana
   usermod -aG sudo ana

   adduser asks you for a password for ana and a few optional details (you can press Enter). You need the password for sudo. If Debian reports that the sudo group or the sudo command is missing, install them first with apt install sudo.

2. AlmaLinux and Rocky:

   adduser ana
   passwd ana
   usermod -aG wheel ana

   On these, the administrators group is called wheel.

B. Give it your SSH key

3. Copy the public key from root to ana, with the correct permissions:

   mkdir -p /home/ana/.ssh
   cp /root/.ssh/authorized_keys /home/ana/.ssh/
   chown -R ana:ana /home/ana/.ssh
   chmod 700 /home/ana/.ssh
   chmod 600 /home/ana/.ssh/authorized_keys

4. From a new terminal window on your computer, log in as ana:

   ssh ana@203.0.113.7

5. Check sudo:

   sudo whoami

   After you enter the password for ana, you should see root. If it works, move on. If not, fix it from the root session you kept open.

C. Turn off root login and password login

6. In the root session, create a separate settings file for SSH:

   nano /etc/ssh/sshd_config.d/00-securizare.conf

7. Write this in it:

   PermitRootLogin no
   PasswordAuthentication no
   KbdInteractiveAuthentication no

   Save with Ctrl+O, Enter, and exit with Ctrl+X. If nano is missing (this happens on AlmaLinux and Rocky), install it with dnf install nano.

   The name starts with 00- on purpose: SSH uses the first value it finds for each setting, and the files in sshd_config.d are read in alphabetical order. On some images, a file such as 50-cloud-init.conf turns on password login; yours is read before it, so it wins.

8. Check the settings before you apply them:

   sshd -t && sshd -T | grep -Ei 'permitrootlogin|passwordauthentication'

   You should see permitrootlogin no and passwordauthentication no, with no errors.

9. Apply them:
   • Ubuntu and Debian: systemctl restart ssh
   • AlmaLinux and Rocky: systemctl restart sshd

D. Check that you haven't locked yourself out

10. New window: ssh ana@203.0.113.7 must work, with the key.
11. New window: ssh root@203.0.113.7 must be refused.
12. Only now close the root session you opened at the start. From now on, run administration commands as ana, with sudo in front.

Good to know

• One key per computer. For your office laptop and your home laptop, create a separate key on each (ssh-keygen) and add each public key on a new line in /home/ana/.ssh/authorized_keys. If you lose a computer, you delete only its line.
• Other people, other users. Don't share the ana account: create a separate user for each person, with sudo only if they need it.
• The SSH port. Moving SSH from port 22 to another port reduces the noise in the logs, but it isn't protection in itself; the key is the protection. If you move it, open the new port in the firewall first (see VPS server: updates and the firewall).

If something doesn't work

• ssh ana@… asks for a password even though you added the key. The permissions on /home/ana/.ssh are wrong, or the owner isn't ana. Repeat step 3 from the root session.
• “Permission denied (publickey)” for ana. The public key isn't in authorized_keys, or you are using a different computer. Check with cat /home/ana/.ssh/authorized_keys from the root session.
• sudo says “ana is not in the sudoers file”. The user isn't in the sudo (or wheel) group. Repeat step 1 or 2, then log out and log back in as ana.
• You closed all sessions and can't log in at all. We don't log into your server. Contact us: if you have the automatic backup or a recent snapshot, we restore your server from it; otherwise, we'll tell you what options you have.