Part III · Shell and commands

29.1 SSH keys and the agent

alsosshssh keyssh keysssh-keygenssh-agentssh-addssh-copy-idid_ed25519id_rsaauthorized_keyspassphrasepermission denied (publickey)unprotected private key file

TL;DR

A key pair replaces your password: the private key stays on your machine, the public one (.pub) goes into ~/.ssh/authorized_keys on each server.
Protect the private key with a passphrase, and let an agent remember it for the session, so you type it once.
Ed25519 is the type to create today: short, fast and safe.

ssh-keygen -t ed25519 -C "alice@laptop"
ssh-copy-id alice@server          # adds your public key over there
ssh -v alice@server               # shows which keys are tried, and why

On your machine

alice@laptopexample

$ atfq 29.1
  Keys      id_ed25519 (ssh-ed25519), id_rsa_old (ssh-rsa) open to others
            (644): ssh refuses it
  Config    3 host entries in ~/.ssh/config, with jump hosts
  Known     4 host keys trusted in known_hosts, names hashed
  Login     1 key may log in here as you (authorized_keys)
  Agent     none in this session: keys with a passphrase ask for it every
            time
  Server    port 2222 · password login no · root login prohibit-password
            (default)

An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.

Pitfalls

"Permissions 0644 for 'id_ed25519' are too open": ssh refuses a private key others can read. chmod 600 ~/.ssh/id_ed25519, and 700 on ~/.ssh.
"Permission denied (publickey)" with the right key: on the server, ~/.ssh or authorized_keys writable by others makes sshd ignore it.
Never copy the private key to a server to "jump" further: use ProxyJump (29.2).
Agent forwarding (ssh -A) lets anyone with root on that server use your keys while you're connected.

Deep dive 2 questions

How does a key log you in without being sent?

The server picks a challenge built from the session; your client signs it with the private key; the server checks the signature with the public key it has in authorized_keys. Only someone holding the private key can produce that signature, and the signature is useless for any other session, so nothing reusable crosses the network.

What does the agent do?

ssh-agent keeps decrypted keys in memory and signs challenges for ssh, which reaches it through the socket named in SSH_AUTH_SOCK. Desktop sessions usually start one. AddKeysToAgent yes in ~/.ssh/config adds a key the first time you use it; ssh-add -l lists what's loaded.

Commands: ssh-keygen ssh-copy-id ssh-add ssh
Paths: ~/.ssh/ ~/.ssh/authorized_keys
See also: 29.2 ~/.ssh/config, jump hosts and host keys
15.1 rwx, octal and umask