Setup SSH

The Proxmox host has SSH enabled by default and so you can access it via the IP address and password you chose during install.

The next step will be to improve security by setting up your workstation SSH key and to disable authentication via password.

Create SSH key on your workstation

Tip

If you do not yet have an SSH key on your workstation, make one:

[bash]: Run this on your workstation:
ssh-keygen

For more information see the chapter on SSH in the Linux Workstation book.

Create SSH config on your workstation

[bash]: Run this on your workstation:
PROXMOX_IP_ADDRESS=192.168.1.2 \
PROXMOX_HOST=pve-router \
cat << EOF >> ~/.ssh/config

Host ${PROXMOX_HOST}
     Hostname ${PROXMOX_IP_ADDRESS}
     User root

EOF

Install SSH key

Copy your public SSH to the Proxmox host:

[bash]: Run this on your workstation:
PROXMOX_HOST=pve-router \
ssh-copy-id ${PROXMOX_HOST}
Info

The first time you connect you will be asked to trust the host ssh key, just type yes and press Enter:

(stdout)
The authenticity of host '192.168.1.2 (192.168.1.2)' can't be established.
ED25519 key fingerprint is SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

When prompted, you must enter the password you chose during install:

(stdout)
root@192.168.1.2's password:

If successful, it will indicate how many keys it copied:

(stdout)
Number of key(s) added: 1

Test connection via key

[bash]: Run this on your workstation:
ssh pve-router

The connection should no longer require your password. Depending on your local SSH agent, you may need to authenticate to unlock your key, but no password should be required to login to the host.

Disable password authentication

Now that you have tested that you can Login to the Proxmox host using your key, you should reconfigure SSH to disable password authentication:

Run this on the Proxmox PVE host
sed -i '/^PasswordAuthentication /d' /etc/ssh/sshd_config
echo -e "\nPasswordAuthentication no" | tee -a /etc/ssh/sshd_config
systemctl restart sshd
Tip

To test that the change has taken effect, you can attempt to login again with an invalid user:

[bash]: Run this on your workstation:
ssh foo@pve-router
(stdout)
foo@192.168.1.2: Permission denied (publickey).

If you see Permission denied (publickey), and it does not prompt you for a password for foo, you have successfully disabled password authentication.