Terminal Tabby + autoryzacja kluczem kryptograficznym SSH

Technology focus / problem being solved

• Replaces repeated SSH password logins (inconvenient and less secure in environments full of automated attacks) with SSH key-based authentication.
• Uses Terminal Tabby to simplify connections to multiple machines/servers and to provide SFTP file transfer.
• Demonstrates how to harden an SSH server by:
  • Disabling password login
  • Enforcing public-key authentication

---

Part 1: Installing & using Tabby (Terminal)

Install Tabby on Windows

• Download the Windows x64 installer
• Run setup and finish installation

Initial configuration

• Set UI language to Polish
• Adjust theme (dark by default; also enables light mode for presentation visibility)
• Disable analytics collection

Create an SSH connection profile

In Tabby settings → Connection profiles → New profile:

• Connection type: SSH
• Fields:
  • Connection name (e.g., “VPS server”)
  • Server address (IP)
  • Username (example: ubuntu; “root” is mentioned as a default but discouraged)
  • Password mode initially to test connectivity

First connection:

• Accept the server’s digital fingerprint

Connection behavior

• On startup, Tabby shows the default Windows command line plus a quick menu of saved connections
• One-click connect for frequently used SSH profiles

SFTP file transfers

After connecting, Tabby provides SFTP actions:

• Upload files/folders to the remote host
• Download files by clicking remote items (choose a local save location)

Usability improvements

• Font size and full-screen options for readability
• Right-click paste for quick command copying/typing

---

Part 2: SSH key generation and secure setup (Windows → server)

Key generation approach

• Mentions a cheat sheet (linked in the video description)
• Uses ssh-keygen with ed25519:
  • ssh-keygen -t ed25519

Key files produced

• Private key (no .pub) — kept secret (local only)
• Public key (.pub) — uploaded to the server

Key naming and organization

• Private/public files are named based on source system (e.g., “VPS from WIN”)
• Keys are moved into a dedicated Windows directory (example: KRSSH)
• Public key is sent to the server; private key remains on the Windows machine

Installing the public key on the SSH server

On the server:

• Uses Midnight Commander (mc) to edit
• Edits an authorized_keys-like file (conceptually authorized_keys)
• Pastes the entire public key line into the file

Configure Tabby to use the private key

Tabby settings → connection profile → SSH key tab:

• Add private key
• Point Tabby to the private key file in KRSSH

Result:

• Tabby connects without password once key authentication is correct

---

Part 3: Server hardening (disable password login)

Update sshd_config

To prevent fallback to weaker authentication, the SSH daemon is configured by editing:

• /etc/ssh/sshd_config (via mc with superuser privileges)

Apply settings via a high-priority snippet

• Adds a new config snippet file at the top alphabetically (example: 10-custom-settings.conf) so it’s applied first.

Key hardening settings (three main ones)

1. PasswordAuthentication no
   • Disallow SSH password login
2. PubkeyAuthentication yes
   • Require public-key authentication
3. PermitRootLogin no
   • Prevent root login (also mentions preventing root/router account login)

Validate and restart SSH

• Validates settings using an sshd -T | grep ... style check (shown conceptually)
• Restarts SSH:
  • systemctl restart sshd

Verification

• From Tabby, SSH key login succeeds
• Password attempts are denied (e.g., “Permission denied” and messages indicating password logins are not supported)

---

Part 4: Repeat for Linux keys and per-user isolation (Linux Mint → server)

Install Tabby on Linux Mint

• Download the appropriate Linux .deb
• Set executable permission

Copy keys to Linux

• Copy private keys from a USB/pendrive into the Linux KRSSH folder

Generate a Linux-specific key (with passphrase)

• Generate a new ed25519 key using ssh-keygen
• Set a passphrase for the private key
• Key naming differs (e.g., “VPS from LIN”)

Add Linux public key to the server

• Append the Linux public key as a separate line in the server’s authorized_keys file

Key isolation / revocation method

Core principle:

• Each user/device should have its own separate SSH key
• If a key is compromised or a device is lost, revoke by deleting only that one line from authorized_keys

Switching keys in Tabby

• Remove the Windows key from the Tabby profile so it won’t be used
• Attempt connection to confirm key-based auth prompts for the key passphrase

---

Outcome / features achieved

• One-click SSH connection in Tabby via configured profiles
• Secure SSH access using public-key authentication
  • Linux-generated private key uses a passphrase
• SSH server hardened to disable password logins
• Integrated SFTP upload/download directly from Tabby
• Operational model for revoking access by removing specific public key entries

---

Guides / tutorial components explicitly included

• Step-by-step install and configuration of Tabby (Windows + Linux Mint)
• Step-by-step creation of SSH key pairs using:
  • ssh-keygen -t ed25519
• Step-by-step population of server authorized_keys with public key lines
• Step-by-step Tabby configuration to use private keys
• Step-by-step SSH daemon hardening:
  • create a top-priority config snippet
  • set PasswordAuthentication no
  • set PubkeyAuthentication yes
  • restart and verify behavior
• Step-by-step generation of separate keys per device/user and revocation by deleting a single line

---

Main speakers / sources

• Main speaker: video narrator/author (referred to as “Hi. M.” near the end; multiple “we” instructions imply one host)
• Referenced tools/documentation:
  • Tabby (terminal client)
  • SSH tools (ssh-keygen, sshd configuration)
  • Midnight Commander (mc) for editing server files