Secure System Communication: Encryption Guide

TL;DR

This guide shows you how to set up secure, two-way encrypted communication between two systems using SSH keys and a simple file transfer method. It’s designed for basic security – more complex setups might be needed depending on your specific requirements.

Setting Up Secure Communication

1. Generate SSH Key Pair (System 1)
   • Open a terminal or command prompt on System 1.
   • Run the following command to generate a new key pair:

     ssh-keygen -t rsa -b 4096

   • When prompted for a file name, accept the default (usually ~/.ssh/id_rsa) or choose a secure location.
   • Important: Set a strong passphrase to protect your private key. Do not leave it blank!
2. Copy Public Key to System 2
   • Display the contents of the public key file (usually ~/.ssh/id_rsa.pub) on System 1:

     cat ~/.ssh/id_rsa.pub

   • Copy the entire output to your clipboard.
   • On System 2, open or create the file ~/.ssh/authorized_keys (create the .ssh directory if it doesn’t exist).
   • Paste the copied public key into this file. Each key should be on a new line.
3. Test SSH Connection
   • From System 1, attempt to connect to System 2 using SSH:

     ssh user@system2_ip_address

   • You will be prompted for the passphrase you set earlier. If successful, you’ll be logged into System 2 without being asked for a password (after entering the passphrase once).
4. Secure File Transfer with SCP
   • SCP (Secure Copy) uses SSH to transfer files securely.
   • To copy a file *from* System 1 *to* System 2:

     scp /path/to/local/file user@system2_ip_address:/path/to/remote/directory/

   • To copy a file *from* System 2 *to* System 1:

     scp user@system2_ip_address:/path/to/remote/file /path/to/local/directory/

5. Automating File Transfer (Optional)
   • For regular, automated transfers, consider using rsync over SSH. It only copies changes, making it more efficient.

     rsync -avz /path/to/local/directory user@system2_ip_address:/path/to/remote/directory/

6. Security Considerations
   • Passphrase Protection: Never share your private key or its passphrase.
   • Key Rotation: Regularly generate new SSH keys and remove old ones.
   • Firewall Rules: Restrict SSH access to only necessary IP addresses.
   • Disable Password Authentication: After confirming SSH key authentication works, disable password authentication on System 2 for increased security (edit the /etc/ssh/sshd_config file and set PasswordAuthentication no). Remember to restart the SSH service after making changes.

     sudo systemctl restart sshd