Overthewire-Bandit Level 13 - SSH

Posted Mar 30, 2026 Updated Apr 2, 2026

By Anthony Yeung 5 min read

Ref:

Overthewire-Bandit13

Bandit Level 13

Level Goal The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Look at the commands that logged you into previous bandit levels, and find out how to use the key for this level.

Commands you may need to solve this level ssh, scp, umask, chmod, cat, nc, install

Helpful Reading Material SSH/OpenSSH/Keys

SSH

ssh bandit13@bandit.labs.overthewire.org -p 2220
FO5dwFsc0cbaIiH0h8J2eUks2vdTDwAn

Below is a clear, detailed explanation of SSH public‑key authentication, based on the Ubuntu documentation
https://help.ubuntu.com/community/SSH/OpenSSH/Keys

I’ll explain it step‑by‑step, give real command examples, and include a simple drawing (diagram) so you can visualize how it works.

SSH OpenSSH Keys — Detailed Explanation

1. What problem SSH keys solve

Normally, SSH uses password authentication:

Client ──(password)──▶ Server

Problems with passwords:

Can be guessed or brute‑forced
Must be typed every time
Less secure than cryptography

SSH keys replace passwords with cryptographic proof of identity.

2. What is an SSH key pair?

An SSH key pair consists of two mathematically linked files:

Key Type	File Example	Where it lives
Private key	`id_rsa`	Client (your computer)
Public key	`id_rsa.pub`	Server

✅ Private key never leaves your computer
✅ Public key is safe to share

3. High‑level flow (drawing)

+--------------------+             +---------------------+
|   Client Machine   |             |   SSH Server        |
|                    |             |                     |
|  id_rsa (PRIVATE)  |─── prove ──▶|authorized_keys file |
|                    |             |  contains PUBLIC    |
+--------------------+             +---------------------+

The server never sees your private key.

4. Step 1 — Generate the SSH key (client side)

On your local machine, run:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

What happens:

-t rsa → RSA key type
-b 4096 → strong key size
-C → comment for identification

You’ll be asked:

Enter file in which to save the key

Press Enter to accept default:

    ~/.ssh/id_rsa
    ~/.ssh/id_rsa.pub

Optional:

Enter passphrase (recommended)

A passphrase protects your private key if stolen.

Files created

    ~/.ssh/
    ├── id_rsa        <-- PRIVATE (keep secret!)
    └── id_rsa.pub    <-- PUBLIC (copy to server)

5. Step 2 — Copy public key to the server

✅ Recommended method

ssh-copy-id username@server_ip

This:

Logs in using your password (one last time)
Appends your public key to: ~/.ssh/authorized_keys

✅ Manual method

If ssh-copy-id is unavailable:

cat ~/.ssh/id_rsa.pub | ssh username@server_ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

6. Server-side file structure

On the server:

    ~/.ssh/
    └── authorized_keys

Contents example:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQ...

Each line = one allowed public key

Now connect:

ssh username@server_ip

✅ If configured correctly:

No password prompt
Optional passphrase prompt (local only)

8. What happens during authentication (deep explanation)

Authentication flow (drawing)

Client: "Here is my PUBLIC key fingerprint"
Server: "I recognize this key"
Server: "Prove you own the PRIVATE key"
Client: signs random data with PRIVATE key
Server: verifies with stored PUBLIC key
Access granted ✅

Important security detail

The private key is never sent
Math proves ownership without exposure

9. Permissions (very important)

Incorrect permissions cause SSH to reject keys.

Client

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

Server

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

10. Common mistakes

Problem	Cause	Fix
Still asks for password	Wrong permissions	Fix `chmod`
Permission denied	Wrong user	Check username
Key ignored	Wrong file	Use `authorized_keys`
Server login disabled	SSH config	Check `/etc/ssh/sshd_config`

11. Optional hardening (recommended)

Disable password login after key works:

Edit server config:

sudo nano /etc/ssh/sshd_config

Set:

PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH:

sudo systemctl restart ssh

✅ Server now accepts only SSH keys

12. Summary diagram (full picture)

Client (Laptop)
┌─────────────────────────────┐
│ ~/.ssh/id_rsa   (PRIVATE)   │
│ ~/.ssh/id_rsa.pub (PUBLIC)  │
└───────────────┬─────────────┘
                │
        public key copied
                │
┌───────────────▼─────────────┐
│ Server                        │
│ ~/.ssh/authorized_keys        │
│ contains PUBLIC keys          │
└──────────────────────────────┘

✅ Key Takeaways

SSH keys = passwordless, cryptographic login
Public key → server
Private key → never shared
Safer, faster, automatable
Standard for Linux admins & cloud servers

If you want, I can:

Explain ED25519 vs RSA
Show Windows / PuTTY examples
Walk through debugging SSH key failures
Draw a more advanced diagram with agents (ssh-agent)

This is OverTheWire Bandit – Level 13 → 14.

You already have access to bandit13, but instead of a password you’re given a private SSH key that must be used to log in as bandit14.

Below is the exact step‑by‑step solution.

✅ Bandit Level 13 → 14 (Using SSH Private Key)

1️⃣ Log in to bandit13 (if not already)

ssh bandit13@bandit.labs.overthewire.org -p 2220

2️⃣ Locate the private SSH key

List files in the home directory:

ls

You should see:

sshkey.private

Inspect it (optional):

cat sshkey.private

⚠️ Do not copy this key outside the server.

3️⃣ Fix SSH key permissions (IMPORTANT)

SSH will refuse to use a key that’s readable by others.

Run:

chmod 600 sshkey.private

Verify:

ls -l sshkey.private

Expected:

-rw------- 1 bandit13 bandit13 ...

4️⃣ Log in as bandit14 using the private key

Use the -i option with ssh:

ssh -i sshkey.private bandit14@bandit.labs.overthewire.org -p 2220

✅ You are now logged in as bandit14

5️⃣ Read the password for the next level

Now that you are bandit14, you have permission to read the file:

cat /etc/bandit_pass/bandit14

🎉 That output is the password for bandit15

✅ Summary of Commands Used

ls
chmod 600 sshkey.private
ssh -i sshkey.private bandit14@bandit.labs.overthewire.org -p 2220
cat /etc/bandit_pass/bandit14

🧠 Why this works

The file is readable only by user bandit14
The SSH private key authenticates you as bandit14
SSH enforces strict file permissions on private keys
Password login is disabled for this level