SSH Keys

Also Known As

TL;DR

Explanation

SSH key authentication uses a private key (kept secret) and a public key (placed in ~/.ssh/authorized_keys on the server). Authentication works by the server sending a challenge encrypted with the public key; only the holder of the private key can decrypt and respond. Ed25519 is the current recommended algorithm — compact, fast, and secure. RSA 4096 is acceptable. Keys should be protected with a passphrase; use ssh-agent to avoid re-entering it.

Common Misconception

Why It Matters

Common Mistakes

• Using RSA 1024 or RSA 2048 — use Ed25519 or RSA 4096 minimum.
• Not setting a passphrase on private keys — an unencrypted key file found anywhere grants full access.
• Not using ssh-agent — repeatedly decrypting the key passphrase manually, or worse, removing the passphrase.
• Leaving password authentication enabled alongside key auth — brute force still possible.

Code Examples

# Insecure SSH setup:
ssh-keygen -t rsa -b 1024  # Too short
# No passphrase set
# /etc/ssh/sshd_config:
PasswordAuthentication yes  # Still allows password login

# Secure SSH key generation:
ssh-keygen -t ed25519 -C 'deploy@company.com'
# Enter strong passphrase
eval $(ssh-agent)
ssh-add ~/.ssh/id_ed25519  # Cache passphrase for session

# /etc/ssh/sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no

References

• ↗ https://www.ssh.com/academy/ssh/keygen

Tags

Related Terms