Ubuntu 16.04 - Creating New User and Adding SSH Keys

@connordphillips

The root user is a super user and the only real super user on the OS by default. You can add sudo users which have permission to escalate to root after authenticating, though root is still a super user :-).

When you run commands as the sudo user, if you escalate to root using su, you become root, so when you check your home directory, it might not be what you expect. You’'ll want to run commands using sudo:

sudo mycommand arg1 arg2 etc

You’ll authenticate and then won’t need to re-authenticate for a period of time. By doing this, you’ll ensure that commands that you run specific to the user are as expected.

…

For example, if I’m logged in as root and create a sudo user, I normally set and create their home directory at the same time.

i.e.

Create Home Directory + .ssh Directory

mkdir -p /home/mynewuser/.ssh

Create Authorized Keys File

touch /home/mynewuser/.ssh/authorized_keys

Create User + Set Home Directory

useradd -d /home/mynewuser mynewuser

Add User to sudo Group

usermod -aG sudo mynewuser

Set Permissions

chown -R mynewuser:mynewuser /home/mynewuser/

chown root:root /home/mynewuser

chmod 700 /home/mynewuser/.ssh

chmod 644 /home/mynewuser/.ssh/authorized_keys

Set Password on User

If you want to be able to log in as the user without an SSH key, setting a password will allow that, as long as PasswordAuthentication is enabled in /etc/ssh/sshd_config.

passwd mynewuser

…

You can check the users home directory by running:

echo $HOME

… while logged in as the user. If you echo $PWD, it’ll give you the current path to the directory that you’re currently in. So if I ran cd /home, running:

echo $PWD

… will give me /home. If my home directory is /home/mynewuser, then $HOME will give me that directory :-).

…

From there, you’ll log in as the user and create your SSH key. I generally use a heavier key with more KDF rounds, though it can delay log in by a few seconds to minutes depending on how many KDF rounds you use.

For example, to generate an RSA key, I’d use:

ssh-keygen -a 1000 -b 4096 -C "" -E sha256 -o -t rsa

For an ED25519 key, I’d use:

ssh-keygen -a 1000 -C "" -E sha256 -o -t ed25519

-a - KDF Rounds (key derivation function) -b - Bit size (applies to RSA, but not ED25519) -C - Sets the comment on the key to be blank -e - Sets the key hash used (sha256 is default) -o - Uses new OpenSSH format for keys -t - Specifies the type of key (RSA/ED25519)

…

With 1,000 KDF rounds, the key takes a few seconds to generate when you use a passphrase, and it will take a few seconds to log in as well. Using KDF generates a more secure key, though you have to be careful as setting it too high will definitely cause severe delays when trying to log in (i.e. 20,000 rounds will take an averages of 2-4 minutes to generate and the same to log in).

Once your public/private key are generated, place the public key in:

/home/mynewuser/.ssh/authorized_keys

Download the private key locally and then remove both from the server as they are no longer needed. The public key only needs to exist in the file above and you shouldn’t keep your private key on the server :-).