# SSH Checklist

### SSH Key Setup Checklist

1. #### Generate SSH Key Pair
    
    
    - Ensure that you have generated an SSH key pair on the client machine (`system a`). 
        - Run the following command and check for the existence of `~/.ssh/id_rsa` (private key) and `~/.ssh/id_rsa.pub` (public key): <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
            </div><div class="overflow-y-auto p-4" dir="ltr">`<span class="hljs-built_in">ls</span> -l ~/.ssh/id_rsa ~/.ssh/id_rsa.pub`</div></div>
    - If the keys do not exist, generate them using: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`ssh-keygen -t rsa -b 4096`</div></div>
    - Ensure the keys have appropriate permissions (600 for private and 644 for public keys): <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`<span class="hljs-built_in">chmod</span> 600 ~/.ssh/id_rsa<span class="hljs-built_in">chmod</span> 644 ~/.ssh/id_rsa.pub`</div></div>
2. #### Copy Public Key to Remote Server
    
    
    - Ensure that the public key has been copied to `system b` and appended to the `~/.ssh/authorized_keys` file. 
        - Use the `ssh-copy-id` command to copy the key: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
            </div><div class="overflow-y-auto p-4" dir="ltr">`ssh-copy-id username@system_b`</div></div>
        - Alternatively, you can manually copy the contents of `~/.ssh/id_rsa.pub` to `~/.ssh/authorized_keys` on `system b`.
    - Verify that the `authorized_keys` file has the correct permissions: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`<span class="hljs-built_in">chmod</span> 600 ~/.ssh/authorized_keys`</div></div>
    - Make sure the `.ssh` directory has the correct permissions: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`<span class="hljs-built_in">chmod</span> 700 ~/.ssh`</div></div>
3. #### Check SSH Daemon Configuration on Remote Server
    
    
    - Ensure the SSH daemon is configured to allow key-based authentication. Check `/etc/ssh/sshd_config` on `system b` for the following settings: 
        - `PubkeyAuthentication yes`
        - `AuthorizedKeysFile .ssh/authorized_keys`
        - `PasswordAuthentication no` (optional, for enforcing key-based auth only)
    - Restart the SSH daemon to apply changes: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`sudo systemctl restart sshd`</div></div>
4. #### Verify Ownership and Permissions
    
    
    - Check ownership and permissions of the user's home directory on `system b`: 
        - Ensure that the home directory and `.ssh` directory are owned by the user and have appropriate permissions: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
            </div><div class="overflow-y-auto p-4" dir="ltr">`<span class="hljs-built_in">chown</span> -R username:username /home/username<span class="hljs-built_in">chmod</span> 700 /home/username/.ssh`</div></div>
5. #### Ensure Correct SSH Command Usage
    
    
    - Use the correct username and hostname when attempting to SSH into `system b`: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`ssh username@system_b`</div></div>
    - If using a non-standard SSH port, specify it using the `-p` option: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`ssh -p <port_number> username@system_b`</div></div>
6. #### Check SSH Agent (Optional)
    
    
    - Ensure that the SSH agent is running and the key is added to it, especially if using `ssh-agent` for key management: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`<span class="hljs-built_in">eval</span> <span class="hljs-string">"<span class="hljs-subst">$(ssh-agent -s)</span>"</span>ssh-add ~/.ssh/id_rsa`</div></div>
    - Verify the keys added to the agent: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`ssh-add -l`</div></div>
7. #### Review SSH Debugging Output
    
    
    - Use the `-v` option with the SSH command to enable verbose mode, which can provide detailed debugging information: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">bash</div><div class="overflow-y-auto p-4" dir="ltr">`ssh -v username@system_b`</div></div>
    - Look for lines indicating whether the key is being offered and any errors that may indicate why the key is being rejected.
8. #### Network Issues
    
    
    - Ensure there are no network issues preventing the connection. Check that `system b` is reachable via the network.
    - Verify that the firewall on `system b` is allowing incoming SSH connections on the specified port.
9. #### SELinux and AppArmor (Linux Specific)
    
    
    - If `system b` uses SELinux, ensure it is not blocking SSH connections: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`sudo setenforce 0  <span class="hljs-comment"># Temporarily disable for testing</span>`</div></div>
    - If using AppArmor, check that it allows SSHD to read the authorized\_keys file.
10. #### Check for Multiple Keys (Optional)
    
    
    - If multiple keys are present, specify the exact key to use: <div class="dark bg-gray-950 rounded-md border-[0.5px] border-token-border-medium"><div class="flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md">  
        </div><div class="overflow-y-auto p-4" dir="ltr">`ssh -i ~/.ssh/id_rsa username@system_b`</div></div>

By following this checklist, you should be able to identify and resolve most issues preventing SSH key-based authentication. If problems persist, examining the verbose output from the SSH command can provide further clues.