Set a Root User on the ERS Server

Introduction

For the purposes of this document, I'll use a fictitious username, alexander.

On your client

Set up operating parameters

# Assumes that HOME is a preset environment variable. If not, add it below
USER="alexander"
SERVER="<<ask the app admin for the ERS IP>>"
SSH_KEY="ers-${USER}"
SSH_KEY_FOLDER="${HOME}/.ssh"
SSH_KEY_FILE="${SSH_KEY_FOLDER}/${SSH_KEY}"

Whenever possible, I will refer to the USER environment variable.

Create a dedicated SSH key

ssh-keygen -t ed25519 -f "${SSH_KEY_FILE}" -C "${USER}@${SERVER}"

When asked for a passphrase, you can either:

• press Enter for no passphrase, or
• use a passphrase for extra security.

Verify you generated the files correctly:

ls $HOME/.ssh/ers-${USER}*

should output

~/.ssh/ers-alexander	~/.ssh/ers-alexander.pub

Fix permissions:

chmod 700 "${HOME}/.ssh"
chmod 600 "${SSH_KEY_FILE}"
chmod 644 "${SSH_KEY_FILE}.pub"

View the public key:

cat "${SSH_KEY_FILE}.pub"

Leave that output available. You will copy it to the server.

On the server

Unix / Linux

Login

From your Mac, log into the ERS server:

ssh deploy@<<ask the app admin for the ERS IP>>

# Ask the app admin for the password

Create the new alexander user

On the server:

USER="alexander"
sudo "adduser ${USER}"

# Linux version)
# sudo "useradd ${USER}"

Provide a temporary password when prompted.

Then add USER to the sudo group:

sudo "usermod -aG sudo ${USER}"

On Ubuntu/Debian, this gives alexander sudo access. Verify:

id "${USER}"

You should see sudo in the group list, something like:

uid=1001(alexander) gid=1001(alexander) groups=1001(alexander),27(sudo)

Create USER SSH directory

Still on the server:

sudo "mkdir -p /home/${USER}/.ssh"
sudo "chmod 700 /home/${USER}/.ssh"
sudo "chown -R ${USER}:${USER} /home/${USER}/.ssh"

Add your public key to authorized_keys

Still on the server:

sudo nano "/home/${USER}/.ssh/authorized_keys"

Paste the full contents of your client's:

~/.ssh/ers-alexander.pub

It should be one single line starting with:

ssh-ed25519

Save and exit.

Then fix permissions:

sudo chmod 600 "/home/${USER}/.ssh/authorized_keys"
sudo chown -R "${USER}:${USER} /home/${USER}/.ssh"

Verify:

sudo ls -la "/home/${USER}/.ssh"
sudo cat "/home/${USER}/.ssh/authorized_keys"

Expected permissions:

drwx------ alexander alexander .ssh
-rw------- alexander alexander authorized_keys

Test from your client

Open a new terminal tab on your client. Do not close your current server session yet. Run:

# change this to your username
USER="alexander"
SERVER="<<ask the app admin for the ERS IP>>"
ssh -i "~/.ssh/ers-${USER} -o IdentitiesOnly=yes ${USER}@${SERVER}"

If everything is correct, you should log in as alexander without being asked for the Linux user password. Check:

whoami

Expected:

<<your USER>>

Check sudo:

sudo whoami

Expected:

root

Add a clean SSH shortcut on your client

On your client:

nano ~/.ssh/config

Add this:

Host ers-alexander
    HostName <<ask the app admin for the ERS IP>>
    User alexander
    IdentityFile ~/.ssh/ers-alexander
    IdentitiesOnly yes

Fix permissions:

chmod 600 ~/.ssh/config

Now you can connect with:

ssh ers-alexander

Better yet, you can add an alias

alias toers='ssh ers-alexander'

and connect with:

toers