Skip to content

vm-access.md

Latest commit

 

History

History
675 lines (458 loc) · 21.9 KB

vm-access.md

File metadata and controls

675 lines (458 loc) · 21.9 KB

VM access

Table of contents

About the VM access

VM access is the process of connecting to a virtual machine over a network using SSH.

The initial connection uses the user root because a fresh VM has no other users. After that, you create a non-root user and switch to it for all further work.

Working as the user root is risky because every command runs with full permissions — a mistake or a compromised session can modify or delete any file, change system configuration, or break the operating system. A non-root user operates with limited permissions by default, so accidental damage is contained. When an administrative action is genuinely needed, the user can escalate temporarily with the sudo command.

After switching to the non-root user, you restrict the SSH connection so that the user root can no longer log in remotely. This reduces the attack surface of the VM: even if an attacker knows the IP address, the most powerful account is unreachable over the network.

Set up the SSH access to the VM

Note

Replace the placeholder <user>.

Complete these steps:

  1. Set up SSH (LOCAL).
  2. Create a VM.
  3. Check that the VM is accessible (LOCAL).
  4. Set up the SSH access to the VM as the user root.
  5. Set up the SSH access to the VM as the user <user>.
  6. Restrict the SSH connection.

Set up SSH (LOCAL)

Set up SSH to connect to a remote host.

Complete these steps:

  1. Check your current shell.
  2. Create a new SSH key (LOCAL).
  3. Find the SSH key files (LOCAL).
  4. Get the SSH public key (LOCAL).
  5. Add the SSH key to the ssh-agent (LOCAL).

Create a new SSH key (LOCAL)

  1. To generate a new key,

    run in the VS Code Terminal:

    ssh-keygen -t ed25519 -C "se-toolkit-student" -f ~/.ssh/se_toolkit_key

    Note: You can replace "se-toolkit-student" with your email or another label.

    Note: -f ~/.ssh/se_toolkit_key sets a custom file path and name.

    Note We'll use the ed25519 algorithm, which is the modern standard for security and performance. We chose this algorithm because it's used in the GitHub docs on generating a new SSH key.

    Note Actually, you generate a key pair: a private key (secret) and a public key (safe to share).

  2. Passphrase: When prompted Enter passphrase, you may type a secure password or press Enter for no passphrase.

    Note: If you set a passphrase, use ssh-agent to avoid retyping it on every connection.

Find the SSH key files (LOCAL)

  1. To verify the keys were created,

    run in the VS Code Terminal:

    ls ~/.ssh/se_toolkit_key*

  2. You should see two files listed.

    The file ending in .pub contains the public key.

    Another file contains the private key.

Caution

Never share the private key.

Get the SSH public key (LOCAL)

  1. To view the content of the public key file,

    run in the VS Code Terminal:

    cat ~/.ssh/se_toolkit_key.pub

    The output should be similar to this:

    ssh-ed25519 AKdk38D3faWJnlFfalFJSKEFGG/vmLQ62Z+vpWCe5e/c2n37cnNc39N3c8qb7cBS+e3d se-toolkit-student

Add the SSH key to the ssh-agent (LOCAL)

  1. To start the agent,

    run in the VS Code Terminal:

    eval "$(ssh-agent -s)"

  2. To add the key to the ssh-agent,

    run in the VS Code Terminal:

    ssh-add ~/.ssh/se_toolkit_key

  3. To list the loaded keys,

    run in the VS Code Terminal:

    ssh-add -l

    You should see your key fingerprint in the output.

Troubleshooting

The agent has no identities.

Add the SSH key to the ssh-agent (LOCAL) again.

Check the VM is accessible (LOCAL)

  1. Connect to the correct network.

  2. Get the IP address of the VM.

  3. To check that the VM is accessible,

    run in the VS Code Terminal:

    ping <your-vm-ip-address>

    You should see the output like this:

    PING <your-vm-ip-address> (<your-vm-ip-address>) 56(84) bytes of data.
64 bytes from <your-vm-ip-address>: icmp_seq=1 ttl=62 time=4.40 ms
64 bytes from <your-vm-ip-address>: icmp_seq=2 ttl=62 time=5.34 ms
64 bytes from <your-vm-ip-address>: icmp_seq=3 ttl=62 time=3.04 ms
...

    The lines should continue being printed.

    Troubleshooting

    Connection timed out

    1. Recreate the VM

Set up the SSH access to the VM as the user root

Complete these steps:

  1. Update the SSH config to connect to the VM as the user root (LOCAL).
  2. Connect to the VM as the user root (LOCAL).

Update the SSH config to connect to the VM as the user root (LOCAL)

  1. Open the file using code: ~/.ssh/config.

  2. Add this text at the end of the opened file:

    • Linux, Windows (WSL):

      Host se-toolkit-vm
   HostName <your-vm-ip-address>
   User root
   IdentityFile ~/.ssh/se_toolkit_key
   AddKeysToAgent yes

    • macOS:

      Host se-toolkit-vm
   HostName <your-vm-ip-address>
   User root
   IdentityFile ~/.ssh/se_toolkit_key
   AddKeysToAgent yes
   UseKeychain yes

    Replace the placeholder <your-vm-ip-address>.

    🟩 Tip

    If ~/.ssh/config already contains a Host se-toolkit-vm entry, skip this step.

Connect to the VM as the user root (LOCAL)

  1. Connect to the correct network.

  2. To connect to the VM,

    run in the VS Code Terminal:

    ssh se-toolkit-vm

  3. If this is your first time connecting:

    1. You will see a message: The authenticity of host ... can't be established.

    2. Type yes and press Enter.

  4. After a successful login, you should see this SSH shell prompt:

    root@<your-vm-name><vm-index>:~#

    🟦 Note

    <your-vm-name> is the same as you specified when creating the VM.

Set up the SSH access to the VM as the user <user>

Note

See <user>.

Complete these steps:

  1. Create the non-root user <user> (REMOTE).
  2. Set up the SSH key authentication for the user <user> (REMOTE).
  3. Update the SSH config to connect to the VM as the user <user> (LOCAL).
  4. Connect to the VM as the user <user> (LOCAL).

Create the non-root user <user> (REMOTE)

Note

See <user>.

Complete these steps:

  1. Set the password for the user <user> (REMOTE).
  2. Provide other information about the user <user> (REMOTE).
  3. Add the user <user> to the group sudo (REMOTE).

Add the non-root user <user> (REMOTE)

Note

See <user>.

  1. To create the user <user>,

    run in the VS Code Terminal:

    adduser <user>

    🟦 Note

    This will create a group with the same name as <user>.

    We'll refer to this group as <user-group>.

    The output should be similar to this:

    info: Adding user `<user>' ...
info: Selecting UID/GID from range 1000 to 59999 ...
info: Adding new group `<user-group>' (1002) ...
info: Adding new user `<user>' (1002) with group `<user-group> (1002)' ...
info: Creating home directory `/home/<user>' ...
info: Copying files from `/etc/skel' ...
New password:

Set the password for the user <user> (REMOTE)

  1. When prompted for a password (New password):

    1. Save it in a password manager to not lose it.

    2. Type it in the shell where you were prompted.

    🟦 Note

    The shell won't show what you type for security reasons.

Provide other information about the user <user> (REMOTE)

Note

See <user>.

  1. Keep the default values for these (press Enter when prompted):

    Full Name []:     
Room Number []: 
Work Phone []: 
Home Phone []: 
Other []:

  2. When prompted Is the information correct? [Y/n]:

    1. Type y.

    2. Press Enter.

    The output should be similar to this:

    info: Adding new user `<user>' to supplemental / extra groups `users' ...
info: Adding user `<user>' to group `users' ...

Add the user <user> to the group sudo (REMOTE)

Note

Replace the placeholder <user>.

  1. To add the user <user> to the group sudo,

    run in the VS Code Terminal:

    usermod -aG sudo <user>

    There should be no output.

  2. To check that the user <user> was added to the group sudo,

    run in the VS Code Terminal:

    groups <user>

    The output should be similar to this:

    <user> : <user-group> sudo users

    🟦 Note

    See <user-group>.

Set up the SSH key authentication for the user <user> (REMOTE)

Note

Replace the placeholder <user>.

  1. To create the .ssh/ directory for the user <user>,

    run in the VS Code Terminal:

    mkdir -p /home/<user>/.ssh

  2. To copy the authorized keys from the user root,

    run in the VS Code Terminal:

    cp /root/.ssh/authorized_keys /home/<user>/.ssh/

  3. To set the correct ownership on the .ssh/ directory,

    run in the VS Code Terminal:

    chown -R <user>:<user-group> /home/<user>/.ssh

    🟦 Note

    See <user-group>.

    See Change the owner and group (recursive).

  4. To set the correct permissions on the .ssh/ directory,

    run in the VS Code Terminal:

    chmod 700 /home/<user>/.ssh

    🟦 Note

    See Set the permissions.

    🟦 Note

    SSH refuses to use keys if the .ssh/ directory is accessible by other users.

    See Mode 700.

  5. To set the correct permissions on the authorized_keys file,

    run in the VS Code Terminal:

    chmod 600 /home/<user>/.ssh/authorized_keys

    🟦 Note

    SSH ignores authorized_keys if it is readable or writable by other users.

    See Mode 600.

Update the SSH config to connect to the VM as the user <user> (LOCAL)

Note

See <user>.

  1. Open the file: ~/.ssh/config.

  2. Find the se-toolkit-vm entry.

  3. Change User root to User <user>:

    • Linux, Windows:

      Host se-toolkit-vm
   HostName <your-vm-ip-address>
   User <user>
   IdentityFile ~/.ssh/se_toolkit_key
   AddKeysToAgent yes

    • macOS:

      Host se-toolkit-vm
   HostName <your-vm-ip-address>
   User <user>
   IdentityFile ~/.ssh/se_toolkit_key
   AddKeysToAgent yes
   UseKeychain yes

    Replace the placeholder <user>.

Connect to the VM as the user <user> (LOCAL)

Note

See <user>.

  1. Connect to the correct network.

  2. Open a new VS Code Terminal.

  3. To connect to the VM as the user <user>,

    run in the VS Code Terminal:

    ssh se-toolkit-vm

    Replace the placeholder <your-vm-ip-address>.

  4. To confirm you are logged in as the user <user>, not the user root, look at the shell prompt.

    You should see:

    <user>@<your-vm-name><vm-index>:~$

    🟦 Note

    The current working directory is the home directory (~).

    <user> is the same as you specified when updating the SSH config to connect to the VM as the user <user> (LOCAL).

    <your-vm-name> is the same as you specified when creating the VM.

    <vm-index> is some number.

Restrict the SSH connection

Complete these steps:

  1. Restrict the SSH config for the user <user> (LOCAL).
  2. Restrict the sshd config for the user <user> (REMOTE).
  3. Restart sshd (REMOTE).
  4. Connect to the VM as the user <user> (LOCAL).
  5. Verify that you can't connect to the VM as the user root (LOCAL).
  6. Verify that you can still connect to the VM as the user <user> (LOCAL).

Restrict the SSH config for the user <user> (LOCAL)

Note

See <user>.

  1. Open the file: ~/.ssh/config.

  2. Add PasswordAuthentication no there:

    • Linux, Windows:

      Host se-toolkit-vm
   HostName <your-vm-ip-address>
   User <user>
   IdentityFile ~/.ssh/se_toolkit_key
   AddKeysToAgent yes
   PasswordAuthentication no

    • macOS:

      Host se-toolkit-vm
   HostName <your-vm-ip-address>
   User <user>
   IdentityFile ~/.ssh/se_toolkit_key
   AddKeysToAgent yes
   UseKeychain yes
   PasswordAuthentication no

    Replace the placeholder <user>.

  3. Connect to the VM as the user <user> (LOCAL) to verify you can connect as the user <user> without a password.

Restrict the sshd config for the user <user> (REMOTE)

Note

See <user>.

  1. Connect to the VM as the user <user> (LOCAL) if not yet connected.

  2. To open the sshd config:

    1. Run in the VS Code Terminal:

      sudo nano /etc/ssh/sshd_config

    2. Type the password for the user <user>.

  3. Find the line PermitRootLogin yes and set it to:

    PermitRootLogin no

  4. Find the line #PasswordAuthentication yes and set it to:

    PasswordAuthentication no

  5. To write the changes:

    1. Press Ctrl+O.
    2. Press Enter.

  6. To close the editor, press Ctrl+X.

Restart sshd (REMOTE)

Note

See <user>.

  1. To validate the sshd config:

    1. Run in the VS Code Terminal:

      sudo sshd -t

    2. Type the password for the user <user>.

  2. If the command prints no output, the config is valid.

    If it prints errors, fix them in /etc/ssh/sshd_config before continuing.

  3. To restart sshd,

    run in the VS Code Terminal:

    sudo systemctl restart sshd

    The output should be empty.

Verify that you can't connect to the VM as the user root (LOCAL)

  1. Open a new VS Code Terminal.

  2. To try to connect to the VM as the user root,

    run in the VS Code Terminal:

    ssh root@<your-vm-ip-address>

    Replace the placeholder <your-vm-ip-address>.

    The output should be similar to this:

    Received disconnect from <your-vm-ip-address> port 22:2: Too many authentication failures
Disconnected from <your-vm-ip-address> port 22