How To Add Public SSH Key To Your WebHostingM cPanel For SSH Access

Take website security to the next level! This comprehensive guide explores generating SSH keys and adding them to your WebHostingM cPanel for secure access using CLI, API (for advanced users), and the cPanel interface.

The Importance of Using SSH

Imagine your website as a high-security vault. Passwords are like single keys, convenient but potentially risky if compromised.

SSH, or Secure Shell, is a cryptographic network protocol that provides a secure way to access a remote server over an unsecured network. It enables secure remote command-line, file transfer, and tunneling capabilities. SSH keys act as a two-factor authentication system, offering an extra layer of security for accessing your server's files and applications.

Integrating SSH with your cPanel server enhances security by enforcing key-based authentication instead of relying solely on passwords.

This guide caters to users of all experience levels, guiding you through generating SSH keys on your local machine (Mac, Windows) and adding them to your cPanel account.

Why Use Key-Based SSH Authentication?

• Enhanced Security: Unlike passwords, SSH keys cannot be brute-forced or guessed. They require both a public and private key for access, making unauthorized login attempts nearly impossible.
• Ease of Use: Once set up, SSH keys allow for seamless and secure access to your server without the need to enter a password each time.
• Automation: SSH keys enable automated processes and scripting, facilitating tasks such as backups, deployments, and server management.
• Restricted Access: By managing SSH keys, you can control access to your server and limit permissions based on individual keys, enhancing overall security.

Understanding SSH Keys

• Public Key: This resides on the server you want to access and acts like a public lock. Anyone can have it.

• Private Key: This stays securely on your local machine and acts like a private key. Only you should have it.

Adding an SSH Key to cPanel (Step-by-Step)

Generating SSH Keys

For Linux and Mac Users:

1. Open Terminal: Locate and launch the Terminal application on your Mac.
2. Generate Key Pair: Enter the following command, replacing your_email@example.com with your actual email address:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Explanation:

• ssh-keygen: This command initiates the SSH key generation process.
• -t rsa: This specifies the key type (RSA is recommended for most scenarios).
• -b 4096: This sets the key size to 4096 bits for enhanced security. Consider 4096 bits the new standard.
• -C "your_email@example.com": This adds a comment to your key, identifying its owner.

3. Press Enter: When prompted for a filename, press Enter to accept the default location (~/.ssh/id_rsa). This creates a private key file named id_rsa in your hidden SSH directory.
4. Enter Secure Passphrase: A strong passphrase acts as an additional security layer. Enter a complex passphrase (avoid using actual words) and re-enter it for confirmation.

Now create a ~/.ssh/config file to automatically load keys into the ssh-agent and store passphrases in your keychain.

touch ~/.ssh/config

Start the ssh-agent in the background.

$ eval "$(ssh-agent -s)"

Modify the file you created earlier:

cd .ssh && vi ~/.ssh/config

Add this to the file:

Host * AddKeysToAgent yes UseKeychain yes IdentityFile ~/.ssh/id_rsa

Add your SSH private key to the ssh-agent and store your passphrase in the keychain.

$ ssh-add -K ~/.ssh/id_rsa

Confirm the key existence:

$ ls -al ~/.ssh

Now copy the generated public key you will add to the cPanel server:

$ cat .ssh/id_rsa.pub

For Windows Users:

Windows has a different workflow but these will help:

1. Download PuTTY: Download and install PuTTY (putty.exe) and PuTTYgen (puttygen.exe) from the official site: https://www.putty.org/
2. Generate Key Pair: Launch PuTTYgen.
3. Select Key Type (Optional): RSA is the default selection, but ED25519 (EdDSA) is a viable alternative if your server supports DSA signatures.
4. Increase Key Size: Change the key size from 2048 to 4096 bits for improved security.
5. Generate Key: Click "Generate" and move your mouse randomly to contribute randomness to the key generation process.
6. Save Public Key: Once generated, copy the public key displayed in the top portion of the PuTTYgen window. You'll need this later for cPanel.
7. Save Private Key: Enter a strong passphrase and save the private key file (ending in .ppk) in a secure location on your Windows machine.

Generate a Key Pair with PuTTY

Download PuTTYgen (puttygen.exe) and PuTTY (putty.exe) from the official site at http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html.

Launch puttygen.exe.

The RSA key type at the bottom of the window is selected by default for an RSA key pair but ED25519 (EdDSA using Curve25519) is a comparable option if your remote machine's SSH server supports DSA signatures.

Increase the RSA key size from 2048 bits to 4096 and click Generate

PuTTY uses random input from your mouse to generate a unique key. Once key generation begins, keep moving your mouse until the progress bar is filled.

When finished, PuTTY will display the new public key.

Right-click on it and select Select All, then copy the public key into a text editor: Sublime Text, VS Code, or even Notepad.

Save the public key as a .txt file. This is important because a rich text format such as .rtf or .doc can add extra formatting characters and then your private key won't work.

Enter a passphrase for the private key in the Key passphrase and Confirm passphrase text fields.

Click Save private key.

Choose a file name and location in Explorer while keeping the .ppk file extension.

Remember the location of the private key file for future use.

If you plan to create multiple key pairs for different servers, be sure to give them different names so that you don't overwrite old keys with new ones.

Convert The Public Key Into The OpenSSH Format

Now open your private key in PuTTYGen.

Click Load.

Select your private key that ends in .ppk and then click “Open”.

Look at the top menu and select “Conversions” -> “Export OpenSSH key”.

Save the new OpenSSH key when prompted.

The public key will be under a public key for pasting into cPanel.

New Windows has a better approach to this and you may want to take a look at the following links:

• https://winscp.net/eng/docs/guide_windows_openssh_server
• https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement
• https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview
• https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse

Adding SSH Key to cPanel

1. Login to your cPanel account.
2. Navigate to Security >> SSH Access.
3. Click on Manage SSH Keys.
4. Select Import Key and paste the public key generated earlier.
5. Optionally, provide a custom name for the key.
6. Click Import to add the SSH key to your cPanel account.
7. Authorize the key for use by clicking on Manage and selecting Authorize.

Tips for SSH Key Management

• Centralize SSH key management for organizations.
• Use unique passphrases for each SSH key.
• Rotate SSH keys regularly to enhance security.
• Avoid sharing private keys between devices.
• Implement alerts for SSH access attempts.
• Consider using SSH key management tools for streamlined administration.

Using Your SSH Key:

Once authorized, you can connect to your server using an SSH client like PuTTY (Windows) or the built-in terminal (Mac/Linux). The client will prompt for your private key passphrase, which is the only password you'll need to enter.

Additional Tips

• Secure Your Private Key: Store your private key on a trusted device and avoid sharing it with anyone.

• Consider a Password Manager: Password managers can securely store your private key passphrase.

• WebHostingM Support: WebHostingM customers can submit a ticket to our engineers at [link to WebHostingM ticket submission page for cPanel] for any assistance you may need.

By following these steps, you can leverage the enhanced security and convenience of SSH key authentication for managing your cPanel server. Remember, strong security practices are vital for safeguarding your website and its valuable data.

Password Best Practices

• Avoid personal information: Don't use names, birthdays, addresses, or other details about yourself, loved ones, or pets.
• Ditch dictionary words: Steer clear of words found in any language, including slang, proper nouns, or technical terms.
• Keep it secret: Never share your passwords with anyone.
• Go paperless: Don't write down your passwords anywhere.
• Uniqueness is key: Create unique passwords for every single website or service.
• Stronger is better: Use a mix of uppercase and lowercase letters, numbers, and symbols. Aim for at least 20 characters.
• Enable two-factor authentication: Add an extra layer of security with 2FA wherever possible.
• Consider password rotation (cautiously): Regularly changing passwords may not be necessary for all accounts. Focus on strong, unique passwords and consider risk factors before changing them.

Need assistance?

For personalized support or assistance, don't hesitate to submit a ticket to our dedicated team at WebHostingM. New to WebHostingM? Explore our range of affordable cPanel hosting plans at WebHostingM Store and embark on a seamless email management journey.