title: "Set up FIPS-compliant secure remote Linux development"

description: "How to set up a FIPS-compliant cryptographic connection between Visual Studio and a Linux machine for remote development."

ms.date: "01/17/2020"

::: moniker range="<=vs-2017"

Linux support is available in Visual Studio 2017 and later. FIPS-compliant secure remote Linux development is available in Visual Studio 2019 version 16.5 and later.

::: moniker-end

::: moniker range="vs-2019"

Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard for cryptographic modules. Implementations of the standard are validated by NIST. Windows has [validated support for FIPS-compliant cryptographic modules](/windows/security/threat-protection/fips-140-validation). In Visual Studio 2019 version 16.5 and later, you can use a secure, FIPS-compliant cryptographic connection to your Linux system for remote development.

To set up a secure, FIPS-compliant connection between Visual Studio and your remote Linux system, follow this guide. It's applicable when you build CMake or MSBuild Linux projects in Visual Studio. This article is the FIPS-compliant version of the connection instructions in [Connect to your remote Linux computer](connect-to-your-remote-linux-computer.md).

Some preparation is required to use a FIPS-compliant, cryptographically secure ssh connection between Visual Studio and your remote Linux system. For FIPS-140-2 compliance, Visual Studio only supports RSA keys.

The examples in this article use Ubuntu 18.04 LTS with OpenSSH server version 7.6. However, the instructions should be the same for any distro using a moderately recent version of OpenSSH.

1. On the Linux system, install and start the OpenSSH server:

```bash

sudo apt install openssh-server

sudo service ssh start

```

1. If you’d like the ssh server to start automatically when the system boots, enable it using systemctl:

```bash

sudo systemctl enable ssh

```

1. Open */etc/ssh/sshd_config* as root. Edit (or add, if they don’t exist) the following lines:

```config

```

> [!NOTE]

> ssh-rsa is the only FIPS compliant host key algorithm VS supports. aes*-ctr is also FIPS compliant, but the implementation in Visual Studio isn't approved. ecdh-* key exchange algorithms are FIPS compliant but Visual Studio doesn't support them.

Some other relevant security options you may want to consider are `PermitRootLogin`, `PasswordAuthentication`, and `PermitEmptyPasswords`. For more information, see the man page for sshd_config or the article [SSH Server Configuration](https://www.ssh.com/ssh/sshd_config).

1. After saving and closing sshd_config, restart the ssh server to apply the new configuration:

```bash

sudo service ssh restart

```

Next, you'll create an RSA key pair on your Windows computer. Then you'll copy the public key to the remote Linux system for use by ssh.

1. On the Windows machine, generate a public/private RSA key pair by using this command:

```cmd

```

The command creates a public key and a private key. By default, the keys are saved to *%USERPROFILE%\\.ssh\\id_rsa* and *%USERPROFILE%\\.ssh\\id_rsa.pub*. (In Powershell, use `$env:USERPROFILE` instead of the cmd macro `%USERPROFILE%`) If you change the key name, use the changed name in the steps that follow. We recommend you use a passphrase for increased security.

1. From Windows, copy the public key to the Linux machine:

```cmd

```

1. On the Linux system, add the key to the list of authorized keys, and ensure the file has the correct permissions:

```bash

cat ~/id_rsa.pub >> ~/.ssh/authorized_keys

chmod 600 ~/.ssh/authorized_keys

```

1. Now, you can test to see if the new key works in ssh. Use it to sign in from Windows:

```cmd