HOMELAB // k3s

Lenovo G50-80 · i7-5500U · 8 GB RAM · SSD 447 GB · SSHD 1 TB (data)

user@homelab:~/docs$ cat ssh.md

SSH

Key-only SSH from the Mac and iPad, with password and root login disabled

# contents

Overview

GoalSSH with per-device keys only
ClientsMac (Terminal), iPad (Termius)
Resultssh homelab works at home and away (via Tailscale); passwords and root login disabled

Each device has its own ED25519 key. The private key never leaves the device; the server holds only public keys in ~/.ssh/authorized_keys. A lost device is revoked by deleting one line.

1. Mac

shell @ mac 
ssh-keygen -t ed25519 -C "mac->homelab"

Use a passphrase; macOS stores it in the Keychain.

ssh config @ mac 
# ~/.ssh/config
Host homelab
    HostName homelab.<tailnet>.ts.net
    User <user>
    IdentityFile ~/.ssh/id_ed25519
    AddKeysToAgent yes
    UseKeychain yes
shell @ mac 
ssh-copy-id homelab

ssh-copy-id uses the account password one last time, appends the public key and fixes permissions.

2. iPad (Termius)

  1. Keychain → Generate Key, type ED25519, name ipad.
  2. Append the public key on the server, one key per line:
shell @ server 
nano ~/.ssh/authorized_keys
  1. Hosts → New Host: hostname homelab.<tailnet>.ts.net, port 22, user <user>, key ipad, no password.

3. Disable password login

text @ server 
# /etc/ssh/sshd_config.d/00-hardening.conf
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
shell @ server 
sudo sshd -t && sudo systemctl restart ssh

Files in sshd_config.d/ are read alphabetically and the first value wins; the 00- prefix takes precedence over files shipped by the installer (e.g. 50-cloud-init.conf).

Verify

shell @ server 
sudo sshd -T | grep -E 'passwordauthentication|kbdinteractive|permitrootlogin'
shell @ mac 
ssh homelab                                   # must succeed
ssh -o PubkeyAuthentication=no homelab        # must fail: Permission denied (publickey)

Notes

  • Authentication failures are explained in the server log: sudo journalctl -u ssh -n 20 --no-pager.
  • Handshake finished followed by a failure in a client means the network path works and authentication did not.