SSL Security Sysadmin Ed25519 SSH Key and Changing SSH port?

Yes you can do that via centmin.sh menu option 16 it will prompt you for existing sshd port number so enter 22, then prompt you for desired new sshd port number and automatically configure it for sshd and csf firewall

it auto renews via cronjob. To list your cronjobs

Code (Text):

crontab -l

auto renewal cronjob

Code (Text):

27 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

For CentOS 7, ED25519 based SSH key should work fine, I've tested it. I usually use ECDSA SSH keys instead of RSA SSH keys just for wider compatibility.

Before you look into ssh key only (+disable password authentication), make sure your web host is setup with features that allow you to regain access to your server if you ever loose your ssh key's private key and that you know how to use those features to regain access.

If you don't know how to use those features, setup a test instance/VPS with that web host and test it out. If you're with web host with hourly billed VPSes like Linode, DigitalOcean, and Vultr then it is relatively cheap to test out for a few hours on a test VPS.

Here's a example text you can use to ask your web host to be sure

There's numerous how to use ssh key login guides online, but not many go beyond that to explain what to do if you loose your ssh private key and are unable to use password logins. And that can come down to your web host and what measures they have in place i.e. out of band console access etc and recovery ISO/cds available.

And some relevant guides with different web hosts about setting up SSH key authentication and also about recovery as well general need to know info.

DigitalOcean

Has out of band console access

• How To Use SSH Keys with DigitalOcean Droplets | DigitalOcean
• How To Recover from File System Corruption Using Fsck and a Recovery ISO | DigitalOcean. Just the part about using Console but not the Fsck and file system recovery steps Don't need to do that just to get ssh access when you loose normal ssh access to your server i.e. loose ssh private key for ssh public key authentication.

Linode

Has out of band console access called Lish

• Use Public Key Authentication with SSH
• Using the Linode Shell (Lish)

Vultr

Has out of band console access

• How Do I Generate SSH Keys? - Vultr.com
• Access Single User Mode (Reset Root Password) - Vultr.com
• Using Finnix Rescue CD to Rescue, Repair, or Backup Your Linux System - Vultr.com

OVH

• Installation of OVH SSH key — OVH Documentation 0.0.1 documentation
• SSH key for Public Cloud — OVH Documentation 0.0.1 documentation
• Creating SSH keys- OVH
• Replacing your lost SSH key pair - OVH
• Become root and select a password - OVH

RamNode

• How do I add an SSH key to my VPS? - Knowledgebase - RamNode

Others

• Finnix Recovery CD - Mammoth Cloud

 

for ports below 1024 you can see what some services use for ports first at CSF - Centmin Mod LEMP stack CSF Firewall default port listing but centmin.sh menu option 16 actually checks if your desired port is already in use and lets you know, so you won't accidentally choose a new sshd port that an existing running service uses or if already defined in CSF Firewall's whitelisted ports list

need to use linux text editor to add cronjob

use crontab -l to view current cronjobs and crontab -e command to invoke nano text editor see guide at HowTo: Add Jobs To cron Under Linux or UNIX?

example of out of box centmin mod setup cronjobs excluding wordpress wp-cli

Code (Text):

crontab -l
13 23 * * * /usr/local/src/centminmod/tools/autoprotect.sh >/dev/null 2>&1
0 */4 * * * /usr/bin/cminfo_updater 2>/dev/null

 

you'd need to use linux text editor like nano or vim to edit /etc/csf/csf.conf variables for TCP_IN and TCP6_IN and change the exit word back to 22 in comma separated list if it exists i.e. 20,21,exit,25 but if exit doesn't exist then and is still showing as 22 in 20,21,22,25 listing, then proceed to the step to revert sshd_config below

Code (Text):

TCP_IN = "20,21,22,25,53,80,8081,110,143,161,443,465,587,993,995,1110,1186,1194,81,9418,30001:50011"
TCP6_IN = "20,21,22,25,53,80,110,143,161,443,465,587,993,995,1110,1186,1194,81,9418,30001:50011"

then restart CSF Firewall service

Code (Text):

csf -ra

then you can revert the backup that was made and grep verify Port is set back to default i.e. Port 22 or #Port 22

Code (Text):

diff -u /etc/ssh/sshd_config /etc/ssh/sshd_config-backup
cp -af /etc/ssh/sshd_config-backup /etc/ssh/sshd_config
grep Port /etc/ssh/sshd_config
service sshd restart

Easiest way to edit configuration or any files on your server is via logging into your server via ssh and directly editing them using nano or vim linux text editors.

For nano which you can read up more about nano here and here. For vim text editor read here and here and thread at WebPerf - Popular Vim Commands – a Comprehensive Vim Cheatsheet

Also there's numerous online how to use guides for nano and vim you can search for via google

 

Not sure what guide you followed by keyphrase isn't meant to be added to authorized_keys see How To Set Up SSH Keys on CentOS 7 | DigitalOcean