Transcription
Hello everyone and welcome back to the Webify channel. In today's video, I will cover something that I did not cover on this channel. Maybe just briefly, but when I was searching uh YouTube and other platforms for modern SSH guide, I could not find anything new updated to keep up with the modern standards. So in this video I'm going to walk you through how you can create your secure private and public key pair so you can securely SSH into your servers. And don't be intimidated is really easy and simple. You just need to follow uh instructions in this video.
So what will differ is that we will never store our public key uh sorry our private key on our main workstation machine. Even if it's Windows, Linux desktop or Mac OS, we will never store our private key in this machine. And uh you may be asking why. Well, what if your machine uh is stolen or got lost? What if you did not even set up the password for your SSH key like in a traditional uh videos for SSH you should do uh the password for your SSH key. So that's why we will utilize already available tools we are already using in 2026 and those are password managers in one password bit warden and maybe other password managers you can easily create your private and public key and they will be locked in your secreer vault.
So in this video I will uh use uh virtual machine with uh Mac OS but for Windows uh Linux desktop it will be basically the same because all the magic is happening inside of the password manager world and also we will be using uh bitwen and also I'm going to show you how you can fully disable port 22 on your servers so you can securely SSH into a server. server using uh tail scale and uh tail scale is basically uh zero trust uh mesh uh VPN is it is creating a local local tail between the machines and you can connect over the local tail so you don't need to open any ports you can also use net or uh pengolin and I will also show you those two other alternatives So, it's going to be a fun video and I hope you like it. Leave a comment and if you have any questions, feel free to leave comments down below. And now, let's get started.
And also before we start, I want to mention that this uh SSH guide is seriously very very simplified because there is so many things you can do with the tools that I'm about to show you in this video. So I will just focus on the basic SSH uh functionality which is to securely connect to your remote machines or other things where SSH key is uh needed and uh I aim uh this guide uh to uh busy agency owners for not very technical people who understand uh completely everything. So bear in mind if you are technical and you understand and I did not cover some things. This is the reason why I try to focus this guide just for uh not technical people so they can get familiar with SSH and build their knowledge from this video because there is seriously so many things so many cool things that uh you can do with the tools like uh Netbird, Pangoline, Tailcale. Uh just to tease you, one of the coolest thing that uh I was able to do is to set up my home printer on my uh local tail. So any machine I tag that can print can print from anywhere in the world directly uh in my home or for example if I'm somewhere out in a holiday or training somewhere and I need to scan some document I can call my VIP can you please scan it put the paper there and for example I'm in the states and I can just open my printer and or the scanning tool from the printer and I can just scan it from anywhere in the world. So there are so many things you can do with those tools. But please bear in mind this is just barely focusing on SSH to login into the uh server so anyone can get familiar with it.
All right. So, uh to create our SSH key in our Bitwarden is pretty simple easy. If you don't have Bit Warden or if you are using one password, uh everything you do is in the application on your desktop. So go to the bit warden and you go to desktop and as you can see you can download standard installer from mega app store or you can just use the homebrew which I like the most. So I will open a terminal and I will just do brew install biten and this will install our bitwarden desktop application. All right bit was installed. We can close this terminal. And now we can just open our bit warden application and we can sign in. Let's just wait a second. Let's open it. And now you need to log into your vault. So I'm going to log myself. I will remember the email. Continue. Enter my master password. I will login with my master password. And yeah, that's uh that's perfect. You are logged in. And actually, let me try to zoom this. Oh, we cannot zoom in. So now this is your bit vault. If you already have items, that's completely fine. All what we need to focus is the SSH key right here under all items. So, let's go to the SSH key and let's click the plus icon to create our SSH key and we can uh name it like you can have multiple SSH key for multiple applications, multiple servers. So, you can name them however you want. In my case I will just using uh testing. You can also select which folder you want to share it. And as you can see by default it is creating SSH ED2551 9 algorithm which is the modern and the best. And that's basically it. You can add some notes if you want. And you can click save. And now you have your private and public key that you can use to remotely authenticate to your machines, applications, GitHub, etc. So that's it. SSH is done.
And the last thing what we need to do is enable the SSH agent on our system from Bitwarden. So when we go uh to the bit then we go to the settings and when we scroll a little bit down to use enable SSH agent you can click that and also ask for authorization when using SSH agent. You can keep it always but I like to keep it remember until the vault is locked. All right. And the timeout for the vault lock is basically you can set how long you want to keep your bit warden vault open. My production uh machine in my workstation I always do 5 minutes because after I'm not using biten vault 5 minutes it will automatically lock right which is great but you can choose whatever you are comfortable with. So I keep it 5 minutes and timeout action lock. And I also want to unlock this machine with the pin code. And I uncheck lock with master password on restart. Okay. And that's basically it. Close. And now we should be able to SSH into our machine. So I will set up some machine and then we will continue. But for now, you create your SSH key and you enable the Bitwen SSH agent on your system.
All right. So to actually use your SSH key, I will demonstrate uh the setup for example in uh heads dashboard and then also on the server itself under your user. So what we need to do is basically you will need to always care about the public key. Never unveil or copy the private key in your clipboard or share it somewhere. This is uh you cannot do it because if somebody get access to this private key they will also generate your public key and what that means they will get access to your system. So never unveil or share it. You don't need to worry about private key. This private key is stored secretly in your bitward vault. So for now copy the public key. Once you copied your public key in a clipboard, just add your SSH key into your headner and we can name it testing and we will set this as default key. Perfect. You can cancel it. And now we can go and create any any server just for the testing purposes. Doesn't matter where. Whatever. I'm going to choose uh Debian. And yeah, basically uh that's it. And we will name it testing SSH. We will create and buy now our server. And as you can see, we did not set up any firewall because for this demonstration is not uh really needed. We are just talking about the SSH key. But if you really want to get the firewall, basically what you need to do is to keep just port 22 open. And on this port, you can remotely authenticate to your uh server. And we can also name it testing. We'll apply this to our server and that's basically it. You just create a firewall rule that only port 22 is allowed on the uh server. Uh perfect. So now you have uh your server created. You can copy uh the server IP address. Open your terminal. Let's do it again. SSH root at server IP. And now as you can see, please unlock your vault to approve the SSH key request. So you enter your pin code. Click unlock. And now it will ask you to confirm the SSH key usage. And let's authorize. And there you are. Now you successfully SSH into your own server using uh the bit worlden world which is the most secure way how you can store your SSH keys uh fam.
So now uh what you can do you can now create your own local user on the server. So let me clear it and let's add at user testing. We will add new password for it. And that's correct. And now you can uh uh add this user to the sudo group. So user mode ag p s p s p s p s p s p s p s p s p s p s p s p s p sudo testing. Now you su login as that user. You navigate to the home folder. And what you need to do right now is to also add this uh SSH key authorized key to this user so we can login as this user. So mkdry. SSH you navigate to the SSH folder and you create uh authorized create authorized keys. And what you want to do is basically insert the key. And let me copy our public key from the bitworden. Go to SSH key. Copy this public key. And you simply just paste it. And you just exit it. And when you can see we have our authorized key and also what good is to create uh permissions ch 60 authorized key and let's verify it. Yes, our authorized key is under our user. So now we can exit this user and you can edit the SSH configuration on the server. So do nano uh /c ssh sshd config and uh this is your main SSH configuration file on your server. You really need to get familiar with this file because if you misconfigure something or you leave it as default is not very secure. So you need to get familiar with it. There are a couple things that you need to change in authentification. So by default the permit root login is without password only with SSH key. But you should never SSH into into the root anyway. So we can just completely disable it. So we will do a permit root login. You can also enable the streak mode which do some background checks and you can also set the max authorization twice. Let's do three. Uh where we are three and max sessions that can be logged in also three. and you enable the pop key authentification and then we can completely disable the password authentification because we are using SSH key. So let's change that to no control O entertrl X to exit and you need to also restart the SSH system control restart SSH. Let's do exit. Let me clear it. And now what you can do instead of root you can just SSH as the user testing and there you are you successfully SSH into your server via the bit warden vault and also under your own user. So this is this is all the magic in a nutshell. But there are also couple ways how we can even further secure our day-to-day workflow following the modern standards and the modern workflows in uh security. So what we're going to do now is we will set up our uh tail scale. Let's get on to it.
All right. And now uh the most important uh part of this video is use modern tools to secure our day-to-day day-to-day life working with remote machines. So I'm going to set set up the tail scale uh which is uh zero trust uh mesh uh overlay VPN network. Uh basically you set up your tail agent. It will create your local tail. It will communicate with the tail scale own uh coordination server which is not open source. is proprietary but the tail scale uh all the parts are open source and you can check also uh the github on tail scale uh there are also uh like the headscale which is open source fork of the telcar coordination server but uh I never use headscale and I really uh like to use tcale but there are also other tools uh that you can use that are fully open source And first one is uh netboard and I already created a video on my channel on uh how you can use or how to selfhost your net and also there is uh if it is fossoral.org Orc uh pengolin. Let me see. Me go duck the go. Uh pengolin pengolin proxy. Here is the pengolin which I also have a video on my channel but I will show you after we cover tail scale how you can it is set set up the same uh functionality. And what I like with tc scale uh for myself personally is the uh the config way how you can configure ACL rules etc etc right it is very easy simple you can store your configs in github and also we can use their graphical user interface inside of the dashboard so this is the reason why I prefer tail scale but I also using net and I'm very very much using pengolin for everything uh else like the proxy and other things. So you can pick whatever uh suits you. I will do also comprehensive uh videos on tail scale net and also uh pengoline for those kind of things what's the differences so you can choose whatever but I think the tcale is most easiest and doesn't require too much so when you go to tscale.com you can see you can go to pricing and as you can see the personal is completely free, limited to three users, 100 devices, and you get access to nearly all Telkale features. Great. And if you run into the business, as you can see, starter is $6, which is very, very affordable and it will greatly increase your security everywhere. So for now we will start for free and make sure you are using your personal email address like uh gmail.com or hotmail.com because if you put your own domain it will automatically flagged as business account. So let's get started for free with our personal and uh as you can see you can only sign in with Google, Microsoft, GitHub, Apple or if you have your own like authentic instance whatever you need. So we will sign in with uh Apple and I will uh log in with my personal Apple account. All right, I sign in with my personal account and you can choose whatever uh you want to Google and you can add your first device which is great and as you can see it will automatically detect your operating system and we want to install this agent on our uh machine so we can SSH into our Linux servers. So, let's download the Telescale for Mac OS. Download it. Perfect. I'm going to open it so I can install it. Let's continue. Enter my password and to accept this. Close. Move to trash. We don't need it. And now at the top you see tails can not connected. So system extension uh requiring approval. So we open our settings and let's enable the network permissions for the tail scale. Click done. And that should be it. Let me >> connect. And now we will connect this device to our tail scale. So let's connect and we can skip this. And that's that's basically it. Now as you can see uh you can see your devices in your account and as I was mentioning you have 100 devices for free. extension is fine. >> Let me quit that so we don't get that warning. Open it again. >> And perfect. Now everything is uh good and everything is running as it should be. So now we have our first device. We can skip this introduction. And as you can see here is your dashboard with your machines. Uh what you can do you can easily for example edit a machine name. You can autogenerate it from OS host name. So let's do Mac OS test and this will be your machine. Let me skip the introduction and also you can edit machine IP before disable key expiry. So you don't need to authenticate every time. So let me just do that. And that should be it. And uh here is your IP addresses that you can connect uh via taillet. But for now we don't need this. What we need to set up uh which is the most important is the access control. And by default, all users and devices can access all users and devices on all ports and protocols. And you probably know where I'm going with this. Uh, this is not good. And we can edit this and we can completely eliminate communicate over everything because for now we just want to allow SSH. So uh source you can choose that all users and your devices can access all users and devices but we don't want that. So what we do uh we will do just uh the auto group owner and for the destination can use auto group and we can specify port TCP TCP 22. two which is our SSH and then we can save our grant and that means uh owners can access the tacked devices on port 22. This is really uh simple and straightforward. We verified it and let me also create our tax. So uh we will create our SSH and the T owner will be basically me my account. So we can save this tag and we can also uh can also edit this. So let's go to edit. Let's do let's do source myself or actually what we can do can create another tag and this will be our workstation and also we specify our account as the tag owner. Let's create uh save and now we can even further uh create the SSH access rules in the tcape. So source uh source will be machines with TAC workstation destination machines with TAC SSH import TCP22 and you can add all kinds of protocols in the future if you need it. I will cover those in a future uh tail scale course or uh deep dive. So let's create uh save this uh grant. Now what we go to? We go to the machines, we go to Mac OS test and we will edit our ACL tax. And since this is our main machines that we will connect to our remote machines, we will add the TC workstation. Perfect. And now it's time to add our second server to our tail net. So let's click add device Linux server. You choose which tag you want to give will be SSH and you generate the installation script. You copy this installation script. Go to your terminal. Elevate yourself to the sudo and you just paste it and it will automatically install and enroll this machine in our tailet. So let's just wait a second and should be up and running. Perfect installation complete. So let's verify systemctl status st and perfect we are connected and let me close this. Let me exit out of this machine to our Mac OS. Also we should see our machines exactly here and any machines you add via the installation script it will automatically have expiry disabled. So if you have 300 machines, you can use this installation script to enroll all machines your in your taillet and also when you open the tcale application it should see the target devices testing and for now this is all what we need is really simple and uh user friendly. All magic basically happens in attacks and also the access control. We can also have a tellcale SSH but that's for other video. And for now what we can do we can go to our firewall and we can completely uh can completely disable the SSH. You can just add anything and we can yeah any any port of your likes. We can click save changes just for the demonstration because if you remove firewall with other rules uh the server will be without any uh firewall. So for now what we can do just keep the uh HTTP HTTPS port open to anything. Let's click save changes. Now with luck we can SSH into our server not using the IP address but actually using the the machine name because this is our machine name in our tail scale. So should be SSH testing at testing SSH. We want to accept this fingerprint and again we will unlock our bitter vault. Click out authorize and there you have it. You you SSH from your local tail to this remote machines to this remote machine where we completely disable port 22. So if you disable uh or disconnect from the tail net, let me just disconnect. We will also be disconnected from this server. And as you can see, we will get the timeout error relatively soon. And as you can see, we cannot even SSH into our server because we disconnected from our taillet. So let me connect again. And now uh we are back. As you can see, last login was from this local IP that from your uh local taillet. So this is something that uh you need to get uh used to it and I know many of you probably don't even know about tail scale or those kind of features that you can use but I try to simplify a lot of things in this video because I try to educate uh non very technical technical people like the busy agency owners and server owners, you know, and this is really important to get familiar with with modern tools. And many of them are completely free. You can self host them. They are open source and they will just make your life way easier. So yeah, now we cover the uh the tail scale. It's pretty simple, straightforward. You can enroll up to 100 devices for free and then you will probably need to pay per device or per user. So it's very very generous and yeah now uh let's uh show you how you can use netbart which is fully open source tailsk like alternative.
All right. So now let's do the same exactly uh with Netbird. So Netbird is fully open source and free to use. Then you see the pricing for for the S offerings is basically on par with the tail scale. So yeah, you can pick whatever you want, but we click to let's get started. Uh we continue with our Google account continue and yeah again it will be our personal let's do just home automation select option where you are from net and what we do now basically we want to yeah we can do peer-to-peer network if you want or uh securely remote access. So let's just do peer-to-peer network. We will now install the net on this machine the same like we run uh for the tc scale. So we will download the net open it. Perfect. We can move to trash the installation. And now as you can see in the tray can see our net. So we will click connect and we will continue with the Google. As you can see we will need to authorize this application. Accept. And now login successful. And now we have uh time to bring our second device which is our Linux machine. So let me copy the installation and let's go here. Let me install it. Or actually we can can do it setup key and we can copy this installation script. Go back to terminal. Uh okay. Let me clear it. Paste that. And now it will install the net agent on our server. And now what we need to do to set up our uh setup key. Let me copy that. Go back to terminal and we will run the net app with our setup key. Press enter. And now our remote machine is also connected to our network works. Let me just ping it from our local terminal. Let me open a different tab and let's ping that. And as you can see everything is working correctly. We can ping our machine over the local IP address that Netbird provides exactly as the tail scale. Close this and let's go back our browser. It works. Continue. Default policy allows connection between all of your devices. We don't want that because we will create our own access list. And yeah, this is your uh net control center. And for my use case, I don't really uh like those kind of, you know, drag and drop uh box for the machines. That's why I prefer Telescale with their own uh UI. So first uh we have our Mac OS shared machines. Let me check the pierce. This is our testing SSH machine and this is our workstation. So let me open it and we can rename that to MacOSS. See our IP address etc etc. And now we need to basically create our groups. And groups you can consider those as a tax as we set up them in uh tell scale. So we will create group. Let's do workstation and then we will create our SSH create group and for the users we will assign our user and also have our peers here. uh that add here and we will add our testing SSH our SSH group and when we go to the workstation want to add our pier which is our Mac OS workstation. Uh perfect. So now when we go to the policies as you can see we have default to connect anything. So let me delete that. And what's also new in an adverb that you can basically use like the smart firewall which is their AI and you can basically type it here that you want. I want workstation group to allow port 22 SSH on SSH group. That should work. This is really the new feature. As you can see, it is in beta. So, uh you need to always check and validate it. But as you can see uh workstation group one pier TCP allow connection through port 22 to our SSH group and we can create our our policy. And actually this was really easy and this is really neat feature from Network because uh you can just type what you want and it will activate it which is kind of great for uh non very technical people. And maybe Telcale should also take some inspiration from it because this is actually the first time I was using this AI AI smart firewall which is great and uh same like in tcale only workstation can communicate to SSH SSH cannot communicate back to the workstation this is really important and that's why you can see the direction from two Right? Because you can always check vice versa and I don't recommend that. I click save changes. And what's really great in a net free you can also add some uh okay it's not available in never mind. And so yeah that should be it. And now what we can check we can actually again try to SSH SSH uh over the private network. So, let me zoom in. Let's do SSH. Testing at testing SSH and should be able connect. Surely we don't. Okay. authorize and yeah it got the same feature uh same workflow so you don't need to remember the IP address you can just SSH with the machine name you set in your uh dashboard. So, yep. This is uh this is pretty simple and I I really love this smart variable which is great. Good job, Misha. Good job. All right. So, we have net covered. And last, we going to set up our uh pengolina.
All right. And let's do this last time with Pengolin. I have full video on my channel how you can set up your own Pengolin server. Uh but for this demonstration we will just use their uh free tier free basic plan so we can start for free and we will need to add our account so that generate the random password let's fine for this let me save it in I agree and let's create our free account special as your character. Okay. Have it in a bit then. Create our account. We copied the verification code. Submit. And first we will need to create our organization which will be testing uh testing will create organization and yeah so for now what we need to do is to create our uh new uh site. Right. So, uh this will be our testing SSH server will be a Linux. It will be system the service and let me copy this installation script. Open the terminal. Install our uh pangolin tunnel. Let's also copy this environment file also. Let's copy this service file and then we will reload the system demon and enable a new team and it should be up and running. So let's click create site. We have status offline for now but it will be fine. So let's do system refresh it. And yes we have status online and we can save all settings. And now what we need to add is our uh machine. So first we will need to create our uh client which will be uh Mac OS and it will be Unix on Mac OS. And basically what we need to do is to install our Bengal. Let's open a terminal. Let's open a new window because we will need our local Mac OS terminal and we'll install our Pengalin service. Perfect. And now we can copy this command to get it up and running. Click create client. And as you can see, we are now uh connected, which is great. And we can save our settings, refresh it. And when we go to the user devices, should download the pengolink client also. You can do it this way. So we can completely uh stop this service. Perfect. Everything is stopped. And now we can download the graphical user interface client for Bengaline. Save it. Open the installer again. Let me move it there. And we can just open it. Let's do pengalin. Click open. Next send install system extension. We will again need to enable the network extension. Done. Closed it. So allow. Done. And done. And again in the top bar you can see login and you can choose the self-hosted or the pengling cloud which is in our case right now. And as you can see uh you will need to authorize this Mac OS client. Click authorize device connected. Go back home. And yeah now we have our sites. And now we have our our uh mesh. All right. So uh how AC als uh we have access to the resources. So what we need to create is our uh private resource which allows us with our authorized machines like this Mac OS workstation to connect privately to our uh public uh VPS machine. So first we need to add our resource. We can name it SSH. We choose uh site which is the server. uh mode will be host and destination will be our public uh IP address of the server. Go back to the pengolin. We can past it. IP address alias will be like ssh testing.com. And as you can see for the alias you need to set the internal DNS alias for easier identification. So you can just sshesting.com doesn't matter. Uh here the port restriction again we will do custom port TCP22. uh we will block UDP and we don't allow the ICMP things. Then we can create our resource. After that we can go back to edit and uh set up the access policy. So the mashing clients will be Mac OS and our users and also we can choose uh roles and you can click save resources and that should be that should be it. Uh basically what we can now uh do is copy this uh site alias go back to the terminal and let's verify it. So let's do SSH testing at SSHesting.com and should be all good. And yes, we are connected again via SSH uh with the pengolin. And again, everything is is working even with the firewall is completely completely disable the port uh 22. And unfortunately uh with pengoline they are not using like the the private the private subnet like uh the tail scale and network are doing they are just doing through the uh new tunnel of connection so that's little bit different and I wish it was a little bit easier you know to to create more more ACL's and more granular control uh like in uh Telkale on Edbert where you can create the groups and each group can have different ACL because for now uh yeah it is what it is. If you are using pengolin and you want to give it a try, feel free. It's simple, easy, different UI, different functions. But in a nutshell, both three methods are zero trust, local and uh secre out of the box. So yeah, that's it. So uh yeah, cover tcale, netbird and panggalin. And I personally I prefer their skill.
All right everyone. So uh that's it uh for this video. I hope you learned something today and uh please don't be afraid of using SSH because as business owner agency owner and you own the servers you are responsible for those servers. So you need to get some basic basic knowledge uh know so uh you can debug something. So and remotely logging to the servers is the first basic step that everyone needs to know. So in this video I'll show you how you can create your SSH key securely in your Bitwarden vault and then also how you can use it with the modern tools that are available and which simplifies a lot of things and those tools in the future will come really really handy as I will also create multiple uh tutorials for more advanced advanced features or how you can use it. So, I seriously hope you like this video. Don't be afraid of SSH. SSH is your friend. And uh yeah, let me know down in the comments below what you think of this video. If you if you like this uh content uh what I'm doing and really soon I will also have the webstify hub where I will share all the all the knowledge and all the tutorials, courses, etc. in the web hub. So stay tuned for that and uh I will see you guys in the next video.