Backing Up and Restoring SSH Keys

The SSH Directory (~/.ssh)

• Minimal/Recommended Permission: 700 (drwx------).
• Access Level: Only the file owner can read, write, and execute the directory, leaving group and others with zero access.
• Ownership: Must be owned by the active user account utilizing the keys.

chmod 700 ~/.ssh
chown -R $USER:$USER ~/.ssh

Files Within the SSH Directory

Permissions vary depending on whether the file contains private data, public data, or configuration settings:

• Private Keys (id_ed25519, id_rsa): Mode 600 (or 400) for owner read/write or read-only access, barring all others.
• Public Keys (id_ed25519.pub, id_rsa.pub): Mode 644 allowing owner read/write and group/others read-only access.
• Authorized Keys (authorized_keys): Mode 600 for owner read/write only.
• Config / Known Hosts (config, known_hosts): Mode 600.

Parent Directory Constraints

OpenSSH also validates the permissions of parent directories in the path leading up to ~/.ssh. Your home directory must not be writable by group or world, with a maximum allowable mode of 755 or 750. If the home directory has overly open permissions, SSH will refuse key authentication even if ~/.ssh is set to 700.

chmod 750 /home/$USER

Using rsync for Backup and Restoration

Assuming your USB directory mount path points to your target location, run the copy operation while preserving permissions:

rsync -rp /path/to/source/.ssh/ /path/to/destination/.ssh/

The flag breakdown includes:

• `-r` (`--recursive`): Recurses into subdirectories and copies all files.
• `-p` (`--perms`): Preserves explicit file permission modes.
• No `-o`/`-g`: Running as a normal user without sudo automatically assigns your current $USER and primary group as the owner.

Alternative Using cp

If rsync is not available, you can perform the copy with cp:

cp -r --preserve=mode /path/to/source/.ssh /path/to/destination/.ssh

Inspection and Hardening Commands

Verify file permissions and apply the mass hardening script:

# 1. Inspect restored files
ls -la ~/.ssh

# 2. Set directory to 700 and private keys to 600
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_* 2>/dev/null || true
chmod 644 ~/.ssh/*.pub 2>/dev/null || true

# 3. Ensure proper user ownership
chown -R $USER:$USER ~/.ssh

Step 1: Find the IP Addresses

First, identify the local IP addresses of both systems.

On your Lenovo ThinkPad (Fedora Linux), open a terminal and run:

hostname -I

(Alternatively, use ``ip a`` and look for the ``inet`` address under your Wi-Fi or Ethernet interface).

On your MacBook Pro (macOS), open Terminal and run:

ipconfig getifaddr en0

(If connected via Wi-Fi, ``en0`` is typically your Wi-Fi interface).

Step 2: Ensure SSH Server is Running on Fedora

Before copying your key, ensure your ThinkPad allows incoming SSH connections. On your ThinkPad, run:

# Check if SSH daemon is active
systemctl status sshd

# If it is not active, start and enable it:
sudo systemctl enable --now sshd

# Ensure Fedora's firewall allows SSH traffic:
sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --reload

Step 3: Copy Your Key from MacBook Pro to ThinkPad

Because your key file may have a custom name (such as porfirio@altair.pub instead of the default id_ed25519.pub), you must pass the -i flag to specify it.

Run this command from your MacBook Pro Terminal (replace username with your Fedora username and 192.168.1.50 with your ThinkPad's IP):

ssh-copy-id -i ~/.ssh/porfirio@altair.pub username@192.168.1.50

1. Confirm the connection prompt by typing yes and hitting Enter.
2. Enter your Fedora user password when prompted.
3. The key will be installed into ~/.ssh/authorized_keys on your ThinkPad.

Step 4: Configure ~/.ssh/config on Your MacBook Pro

Since your key file has a custom name, macOS will not automatically use it when running a standard SSH connection. To make connecting seamless, add an entry to your ~/.ssh/config file on your MacBook Pro:

1. Open the configuration file on your Mac:

   nano ~/.ssh/config
   

2. Add the following host block:

   Host taylor
       HostName 192.168.1.50
       User username
       IdentityFile ~/.ssh/porfirio@altair
   

   (Replace ``192.168.1.50`` with your ThinkPad's IP and ``username`` with your Fedora account name).

3. Save and exit (Ctrl + O, Enter, then Ctrl + X).

Step 5: Test Passwordless SSH

Now, from your MacBook Pro, you can connect passwordlessly by running:

ssh taylor