-------------------------------------------
  * **ssh** 
  * **Jonathan Haack**
  * **Haack's Networking**
  * **netcmnd@jonathanhaack.com** 

-------------------------------------------

Generate keys

  ssh-keygen
  
Send your public key to trusted parties by copying the output below.  Code Talkers should email them to [[mailto:netcmnd@jonathanhaack.com|netcmnd]]

  cd ~/.ssh/
  cat id_rsa.pub
  
If you emailed me your key, I can add you to the Code Talkers Hacking Club Git Lab.  Now, you should enable your digital ocean vps for ssh as follows

  ssh-copy-id username@xxx.xxx.xxx.xxx
  
That's it - you should now no longer need to enter your password.  If this is not working, check your configuration using the commands below and try again.  You might need to enable public key authentication.

  cd /etc/ssh/
  sudo nano sshd_config
  sudo systemctl restart sshd.service
  sudo systemctl restart ssh.service

Keep those public and private key pairs protected.  If you did not change anything, they have the permissions below.  But we all make mistakes!

  chmod 700 ~/.ssh 
  chmod 644 ~/.ssh/id_rsa.pub
  chmod 600 ~/.ssh/id_rsa
  chmod 755 ~/

Using with screen ... more later

  ssh -t xx.xx.xx.xx screen -DRO
  
config options for /etc/ssh/sshd_config
  
  Port 53535
  PubkeyAuthentication yes
  PasswordAuthentication no
  PermitRootLogin prohibit-password
  Protocol 2
  AllowUsers sally
  AllowUsers johnny
  PermitEmptyPasswords no
  X11Forwarding yes
  PrintMotd yes
  ChallengeResponseAuthentication no
  UsePAM yes
  
Then, always restart the service
  
  sudo systemctl restart sshd.service
  
Debian 14 changes to ssh. The kex packets are so large they may not traverse on vpn connections, etc. On the box you connect to open ''sudo nano /etc/ssh/sshd_config''"

  KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256,diffie-hellman-group14-sha256
  
On the box reaching out or from which you are connecting, open ''sudo nano /etc/ssh/ssh_config'' and enter these two lines at the end with the same indentation:

  KexAlgorithms curve25519-sha256
  IPQoS none

If you have not yet noticed, nor made any changes and need to connect quickly, use the following:

  ssh -o KexAlgorithms=curve25519-sha256 -o IPQoS=none root@10.13.13.20

Then, if you use git across a vpn, you will now need to accept those environment variables. So on the git server's sshd_config file, add the git protocol as an allowance:

  AcceptEnv LANG LC_* GIT_PROTOCOL

 --- //[[alerts@haacksnetworking.org|oemb1905]] 2026/09/11 17:38//