SSH Keys for AWS

What Are SSH Keys?

SSH keys are a secure way to log into servers without passwords. They work like a lock and key:

• Private key = Your house key (keep it secret, keep it safe!)
• Public key = The lock on your door (share this with servers)

When you connect to a server, it checks if your private key matches the public key it has on file.

Your Computer                     AWS Server
┌─────────────────┐              ┌─────────────────┐
│  Private Key    │──────────────│  Public Key     │
│  (id_rsa)       │   Proves     │  (authorized)   │
│  KEEP SECRET!   │   identity   │                 │
└─────────────────┘              └─────────────────┘

Step 1: Check for Existing Keys

First, check if you already have SSH keys:

Step 2: Generate a New SSH Key

We'll use Ed25519 - it's more secure and faster than RSA.

Step 3: View Your Public Key

You'll need to copy your public key to give to AWS:

Step 4: Add Key to AWS

For Lightsail

1. Go to Lightsail Console
2. Click Account → SSH keys
3. Click Create new
4. Give it a name (e.g., "MyLaptop")
5. Paste your public key
6. Click Create

For EC2

1. Go to EC2 Console
2. In the left sidebar, click Key Pairs (under Network & Security)
3. Click Actions → Import key pair
4. Name it (e.g., "my-laptop-key")
5. Paste your public key
6. Click Import key pair

Step 5: Connect to a Server

Once your server is running and has your public key:

Step 6: Configure SSH for Convenience

Create an SSH config file for easier connections:

Security Best Practices

Protect Your Private Key

Use Different Keys for Different Purposes

Consider having separate keys for:

• Personal projects
• Work servers
• Highly sensitive systems

bash
Copy
# Generate a work-specific key
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_work -C "[email protected]"

Rotate Keys Periodically

• Generate new keys annually
• Remove old keys from servers when no longer needed
• If a key might be compromised, replace it immediately

Troubleshooting

"Permission denied (publickey)"

bash
Copy
# Check key is loaded
ssh-add -l

# Add your key to the agent
ssh-add ~/.ssh/id_ed25519

# Verify correct username
# Lightsail Ubuntu = ubuntu
# EC2 Amazon Linux = ec2-user
# Debian = admin

"WARNING: UNPROTECTED PRIVATE KEY FILE!"

bash
Copy
# Fix permissions
chmod 600 ~/.ssh/id_ed25519

Connection Timeout

1. Check the server's firewall allows SSH (port 22)
2. Verify the IP address is correct
3. Ensure the server is running

"Host key verification failed"

The server's identity changed (or you're connecting to a different server):

bash
Copy
# Remove old host key (only if you know why it changed!)
ssh-keygen -R your-server-ip

Quick Reference

What's Next?

You now have SSH keys ready for secure server access. In the next lesson, we'll use them to deploy an application to AWS Lightsail - the simplest way to run a traditional server on AWS.