@oasysweb

Instead of the DigitalOcean web-based console, I would recommend using PuTTy on Windows and Terminal or Hyper on MacOS so that you have copy/paste available. It’ll definitely ease the process since the vast majority of what you do through the CLI will require it at some point unless you simply like typing everything out by hand :-).

That said, when you’re running:

nano ~/.ssh/authorized_keys

The ~ signifies root or home when it comes to directories. If you’re logged in as the root user, then the above is actually opening this file:

/root/.ssh/authorized_keys

So the command is the same as:

nano /root/.ssh/authorized_keys

The only time the ~ will apply to your user, seyi, is when you are logged in to SSH as that user. It will then create a file relative to that users home directory.

…

So let’s run through the steps from the start and hopefully that’ll help you get this resolved.

What I like to do is first create the users home directory as well as their .ssh directory. We can do this in one shot by using:

mkdir -p /home/seyi/.ssh

Once we have the home directory, we can now create our user and set their home directory using:

useradd -d /home/seyi seyi

Now if you want this user to be a sudo user, you can add them to the sudo group using:

usermod -aG sudo seyi

The above appends the user to the sudo group so that we’re not changing the main group (i.e the group seyi still exists and can be used).

Now, to generate an SSH key pair for the user seyi we can cd in to the .ssh directory we created:

cd /home/seyi/.ssh

and run:

ssh-keygen -t rsa -b 4096

When prompted for a location, simply enter in /home/seyi/.ssh and give the key a name. For example you could use:

/home/seyi/.ssh/seyi

It’ll then output seyi and seyi.pub in /home/seyi/.ssh, so you should have:

/home/seyi/.ssh/seyi
/home/seyi/.ssh/seyi.pub

Now we’ll use cat to echo the contents of seyi.pub in to authorized_keys. This file doesn’t exist yet, but it will be automatically created for us using this command:

cat /home/seyi/.ssh/seyi.pub >> /home/seyi/.ssh/authorized_keys

Now we need to setup proper permissions on our files and directories using the user seyi and the group seyi.

chown -R seyi:seyi /home/seyi/*

chmod 700 /home/seyi/.ssh

chmod 644 /home/seyi/.ssh/authorized_keys

Now you should login and download:

/home/seyi/.ssh/seyi
/home/seyi/.ssh/seyi.pub

and then remove them from the directory using:

rm /home/seyi/.ssh/seyi

rm /home/seyi/.ssh/seyi.pub

You’ll use the seyi file as your private key file. Keep this file safe. If you lose it, you’ll have to repeat the above all over.

That being said, you won’t be able to login using SFTP with this user just yet as changes need to be made to /etc/ssh/sshd_config first.

First:

sudo nano /etc/ssh/sshd_config

Find:

Subsystem sftp /usr/lib/openssh/sftp-server

Comment it out so that it looks like:

#Subsystem sftp /usr/lib/openssh/sftp-server

And below it add:

Subsystem sftp internal-sftp

Now find:

UsePAM yes

and below it add:

Match Group sftpusers
    ChrootDirectory %h
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTCPForwarding no
    PasswordAuthentication yes

Exit and save. Now we’ll create a new group called sftpusers:

groupadd sftusers

and then add seyi to that group as well:

sudo usermod -aG sftpusers seyi

Then restart SSH:

sudo service ssh restart

Now, even though you’re using SSH Keys to login, you’ll still need a password to use sudo, so we need to set a password on seyi:

passwd seyi

At this point, using the private key file, you should be able to login to SFTP as seyi and when you login to SSH, that user will now be a sudo user as well, so commands such as:

sudo apt-get update

will prompt you for a password and then execute.