The public key is pre-installed in the admin home directory under the name authorized_keys (/home/admin/.ssh/authorized_keys). You have the option to download the private key pair for use with a Command Line Interface (CLI) based SSH client. Alternatively, AWS provides a browser-based SSH client that is ready to use and is available from your Lightsail console as a button "Connect Using SSH".


<div class="image-full-width">
<img src="https://cdn.kahimyang.com/resources-22/browser-ssh.avif" alt="Browser based SSH Client" loading="lazy"/>
</div>

<h4>
CLI Based SSH client
</h4>


Use the command below when using CLl based SSH client. Replace "/path/to/downloaded/private-key.pem" with the downloaded private key. Replace "your-domain-or-ip-address" with your actual domain name or IP address of your Lightsail instance.


<pre>
<code class="language-bash line-numbers normalize-whitespace">
ssh -i /path/to/downloaded/private-key.pem 
		admin@your-domain-or-ip-address
</code>
</pre>



The downloaded private key is required for use passwordless with third party tools, such as FTP clients, SQL Workbench, etc.

<h4>
Additional Users
</h4>

While the "admin" user is adequate for most operations, there may be instances where you need to create additional users. Proceed with the following to establish a new user while logged in as "admin".


<pre>
<code class="language-bash line-numbers normalize-whitespace">
sudo adduser newuser
</code>
</pre>


Substitute "newuser" with a username of your preference. Respond to the prompts that will appear including prompt for password. If you need to alter passwords in the future, use the subsequent command:


<pre >
<code class="language-bash line-numbers normalize-whitespace">
echo 'username:newpassword' | sudo chpasswd
</code>
</pre>


To add administrative privileges to "username", add it to the sudo group:


<pre>
<code class="language-bash line-numbers normalize-whitespace">
sudo adduser username sudo
</code>
</pre>

<h4>
Generete SSH Key Pair for "newuser"
</h4>

From Windows 11, issue the following command to generate SSH key pair for the Debian user just created from the preceeding steps.


<pre>
<code class="language-bash line-numbers normalize-whitespace">
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
</code>
</pre>

<div style="margin-left: 25px;">

-t is the type of key to create, default is rsa ; 
-b is the number of bits in the key, the default is 3072 bits; 
-C is comment.

</div>

The SSH Key pair is written as C:\Users\user\.ssh\id_rsa for the private key, and C:\Users\user\.ssh\id_rsa.pub as the public key. 


Rename "id_rsa.pub" to "authorized_keys".


Upload the renamed public key to the Debian server using FTP client (I use FileZilla) to "newuser" home SSH directory (/home/username/.ssh/). authorized_keys should be owned by the "username" with file permisson of 600. 


From Debian 12 command line terminal, while logged in as "admin", issue the following commands:


<pre>
<code class="language-bash line-numbers normalize-whitespace">
sudo chown username:username 
		/home/username/.ssh/authorized_keys
</code>
</pre>


And then change file permissions.


<pre>
<code class="language-bash line-numbers normalize-whitespace">
sudo chmod 600 /home/username/.ssh/authorized_keys
</code>
</pre>


<h4>
Using SSH Passwords instead of SSH Keys
</h4>

It's important to note that while SSH passwords are convenient and user-friendly, they are generally less secure than SSH keys. Passwords are more susceptible to brute-force attacks, phishing, and human errors. Therefore, the choice between using SSH passwords or SSH keys will depend on your specific needs.

<h4>
Continue to Use Passwords
</h4>

Using nano or any of your favorite text editor, edit the SSH daemon configuration file which is /etc/ssh/sshd_config. Look for these lines and make sure their values are yes. Also make sure you are editing sshd_config file not the ssh_config.


<pre>
<code class="language-bash line-numbers normalize-whitespace">
PasswordAuthentication yes
KbdInteractiveAuthentication yes
</code>
</pre>


Don't forget to create a backup of your configuration file prior to making any changes. This ensures you have a saved version of the last functional configuration.


Restart sshd server:


<pre>
<code class="language-bash line-numbers normalize-whitespace">
sudo service sshd restart
</code>
</pre>


Finally, when creating passwords, it's crucial to make them strong and secure. Include a mix of uppercase and lowercase letters, numbers, and special characters. Passwords with 16 characters or more is ideal.


That's it. Thank you for reading.

Managing User Access on Amazon Web Services Lightsail Instance in Debian 12