Shell Scripting in One Shot | SSH Key Setup & File Permissions

This chapter covers the fundamental workflow for provisioning and securely connecting to a remote Linux instance using SSH (Secure Shell). It explains the necessity of private key protection, Linux file permission models, and how to apply and verify restrictive permissions using chmod and ls -l before initiating a remote server connection.

1. Prerequisites for Remote Linux Access

To work with remote Linux environments and run automation scripts, three baseline requirements must be established:

1. A Running Linux Machine: A virtual machine hosted on a cloud provider such as AWS EC2, GCP, or Azure.
2. A Command Line Interface (Bash Terminal): A terminal application on your local workstation to execute shell commands.
3. Secure Connectivity Mechanism (SSH): An encrypted network protocol allowing interactive shell access from your local terminal to the remote instance.

Local Terminal (SSH Client)
   |
   | Encrypted Connection (Port 22)
   v
Remote Linux Machine (AWS EC2 Instance)

2. Understanding SSH (Secure Shell) Architecture

SSH (Secure Shell) is a cryptographic network protocol used for operating network services securely over an unsecured network. It relies on Asymmetric Cryptography using a key pair:

• Public Key: Stored on the remote Linux machine (inside ~/.ssh/authorized_keys).
• Private Key (.pem or .id_rsa file): Retained locally on your machine. This key must be kept secret and protected from unauthorized local access.

When connecting, the client uses the private key to authenticate identity against the remote server's public key without transmitting the key itself across the network.

3. Step-by-Step Guide: Connecting to AWS EC2 via SSH

Step 1: Launch and Select the Instance

1. Launch an EC2 instance in the AWS Management Console.
2. Ensure the instance status displays as Running.
3. Select the instance checkbox and click Connect.

Step 2: Obtain Connection Instructions

1. Navigate to the SSH client tab under the connect menu.
2. Locate the pre-formatted SSH connection string provided by AWS, which structured as:

ssh -i "your-key-name.pem" ubuntu@ec2-xx-xx-xx-xx.compute-1.amazonaws.com

Step 3: Locate the Downloaded Private Key File

Open your local terminal and navigate to the directory where your .pem key file was saved upon creation (typically the Downloads directory):

cd ~/Downloads

4. Deep Dive into Linux File Permissions

Linux is a multi-user system where access to files and directories is strictly controlled. Every file has three permission targets and three permission types:

Target Categories

• User (u): The individual owner of the file.
• Group (g): Users belonging to the file's assigned group.
• Others (o): All other users on the system.

Permission Types & Octal Values

5. The chmod 400 Command: Securing Private Keys

OpenSSH clients enforce strict security policies: if a private key file is accessible by other users or groups, SSH will reject the key and refuse the connection.

Applying Restrictive Permissions

To ensure the private key file is readable only by the current user and completely inaccessible to groups and others, execute chmod 400:

chmod 400 shell-scripting-for-devops.pem

Deciphering chmod 400 Octal Notation

• User (4): Read-only ($4 = r$, $0 = -$, $0 = - \implies \text{r--}$).
• Group (0): No permissions ($0 = ---$).
• Others (0): No permissions ($0 = ---$).

Resulting Notation

The resulting permission string evaluated by Linux is -r--------.

6. Verifying File Permissions with ls -l

To verify that the permission settings were updated correctly, list the detailed directory contents using ls -l:

ls -l shell-scripting-for-devops.pem

Sample Command Output Breakdown

Anatomy of the output string -r--------:

7. Common Pitfalls & Troubleshooting SSH Connection Issues

8. Complete Execution Flow Walkthrough

Summary and Key Takeaways

• SSH Requirement: Remote Linux connection requires an SSH client, a remote host address/IP, and a valid cryptographic key pair.
• Private Key Security: Private keys (.pem files) act as passwords and must be stored securely on your local system without open broad permissions.
• Strict SSH Client Rules: SSH clients reject connection attempts if the private key permissions are world-readable or group-readable.
• The Role of chmod 400: Executing chmod 400 <key.pem> assigns read-only rights ($r$) to the file owner and revokes all rights from groups and others ($000$).
• Inspecting Permissions with ls -l: The ls -l command displays file metadata, including owner, group, size, and the 10-character permission string (e.g., -r--------).
• Target Categories: Linux permission strings are evaluated across three distinct scopes: Owner (User), Group, and Others.