How to access remote systems over Meshnet using SSH

Discover the best practices for accessing remote systems securely over Meshnet using SSH, including key-based authentication.

Introduction

With the advancement of technology, remote system management has become crucial in today's digital landscape. Secure Shell (SSH) is a popular choice when it comes to accessing remote servers, desktop computers, and devices like Raspberry Pi due to its flexibility and efficiency. While the client-server architecture of SSH makes communication between devices secure, it is not completely risk free, especially if you rely on password authentication.

Used in conjunction with Meshnet, the SSH method can be as safe as physically accessing the server. Not only does Meshnet save time and travel costs, allowing you to connect directly to your remote device, but it also protects your SSH connection. Using an SSH key pair to authenticate your identity provides an additional layer of security by reducing the risk of password-based attacks.

This article explains what an SSH connection is, how it can be established via Meshnet, and how you can generate an SSH key pair to additionally protect the connection.

What is SSH?

SSH is a command-line access method that lets you log in to another computer, execute commands, and transfer files between computers.

Being a lightweight protocol, SSH is typically used for remote server administration and is especially prevalent in the Linux infrastructure.

Using SSH on Linux, Windows, and macOS

While SSH is mostly used for controlling Linux machines, both Windows and macOS can also be accessed using this method. All three operating systems employ an open-source implementation of SSH tools called OpenSSH server.

Enable SSH access

To make your device accessible via SSH, you need to install and enable the OpenSSH server software.

Note

In this guide, Ubuntu 22.04.1 LTS serves as the example for the provided instructions.

To install SSH server on Linux:

  1. Open the terminal and install the SSH server by running this command:

    sudo apt update && sudo apt install openssh-server

  2. Once the installation is complete, confirm that the SSH service is running by checking its status. The output should tell you that the service is active. Run the following command:

    sudo systemctl status ssh

  3. To prevent the firewall from blocking your remote connection, open the SSH port by typing:

    sudo ufw allow ssh

You can now connect to your Linux system via SSH from any remote device over Meshnet.

Connect to your remote computer through SSH

Before attempting to connect, ensure that you have the correct username for the remote computer account.

Tip

To view your username, run the following command in Command Prompt (on Windows) or Terminal (on Linux or macOS):

whoami

To access your remote system via SSH from a desktop device:

  1. Open Command Prompt (on Windows) or Terminal (on Linux or macOS).

  2. Enter the following command, where <username> is your remote PC account name and <server> is the Nord name or Meshnet IP of the computer you want to access:

    ssh <username>@<server>

    Example

    ssh ubuntu@100.105.90.201

    or

    ssh ubuntu@secret.meerkat-altai.nord

  3. The first time you connect, you will be asked to verify the authenticity of the server. This message is displayed to make sure you’re connecting to the correct remote server. Type yes to continue, as shown:

  4. Enter the password for the specified username.

You should now be connected to your remote device using SSH.

Configuring SSH keys

An SSH key is a cryptographic key that is used for user authentication while establishing an SSH connection. It increases the security of SSH connections and allows for efficient automation, as it doesn't require human intervention for authentication.

Generate an SSH key

To use key-based authentication, you first need to generate a key pair on the device from which you will be making an SSH connection.

  1. Run the following command in Command Prompt (on Windows) or Terminal (on Linux or macOS):

    ssh-keygen

  2. Press Enter to keep the default file location.

  3. For additional security, you can choose a custom password. Otherwise, press Enter.

A pair of keys (private and public) will be generated with the same id_rsa name. However, the public key can be distinguished from the private key by its file extension, which is .pub.

Copy your public SSH key to a remote device

To use SSH keys for authentication, you need to copy the public key of your device to the device you will be accessing. For example, if you are using Windows and want to connect to a Linux server, you need to copy the public SSH key of the Windows device to the Linux machine.

When establishing an SSH connection, the public key is matched with the private key to authorize the connection.

Allow SSH key authentication on Windows

To connect to a Windows device using an SSH key, you must first enable public key authentication. Otherwise, you will be asked to enter the SSH password even after sharing the public key.

On the remote device that you will be accessing, take the following steps:

  1. Open PowerShell as an administrator.

  2. Navigate to the ssh folder by using the cd command:

    cd C:\ProgramData\ssh

  3. Run the following command to create a new administrators_authorized_keys file which will store the public keys of the connecting devices:

    New-Item -ItemType File -Name administrators_authorized_keys

  4. Update the permissions to the newly created file with the following command:

    icacls administrators_authorized_keys /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"

  5. Run the command below to open the sshd_config file:

    notepad sshd_config
  1. Locate and uncomment the PubkeyAuthentication yes line by removing the hash (#) symbol at the start.

  2. Press Ctrl + S to save changes and exit Notepad.

To exchange the SSH public key, follow these steps on the device from which you want to establish an SSH connection:

  1. Open PowerShell.

  2. Depending on the device that you will be accessing, run the following appropriate commands, where <username> is the username of the remote device's account and <server> is the remote device’s Nord name or Meshnet IP.

    • If you're copying your SSH key to a Linux or a macOS device, use this command:

      type $env:userprofile\.ssh\id_rsa.pub | ssh <username>@<server> "cat >> .ssh/authorized_keys"

      Example

      type $env:userprofile\.ssh\id_rsa.pub | ssh ubuntu@secret.meerkat-altai.nord "cat >> .ssh/authorized_keys"

    • If you're copying your SSH key to a Windows device, use the following three commands:

      $PublicKey = Get-Content "$env:userprofile\.ssh\id_rsa.pub"
      $CopyKey= "echo $PublicKey >> %programdata%\ssh\administrators_authorized_keys"
      ssh <username>@<server> $CopyKey

      Example

      $PublicKey = Get-Content "$env:userprofile\.ssh\id_rsa.pub"
      $CopyKey = "echo $PublicKey >> %programdata%\.ssh\administrators_authorized_keys"
      ssh meshnet@secret.meerkat-andes.nord $CopyKey

  3. If prompted, type in yes and press Enter to confirm the key fingerprint.

  4. Enter the remote device’s account password and press Enter.

Once the SSH key exchange is complete, you can use the same format to establish an SSH connection to the remote device:

ssh <username>@<server>

However, you will not be prompted to enter a password unless you choose a passphrase while generating the SSH key. And now you can securely access your remote device via SSH over Meshnet.

Last updated

© 2024 Nord Security. All Rights Reserved.