SSH Basics: Keys and Agent

Why keys, not passwords

SSH keys replace passwords with cryptographic key pairs. The private key stays on your machine; the public key goes on every server you log into. The server checks that you hold the private key without ever seeing it. Faster, safer, scriptable.

Generate

ssh-keygen -t ed25519 -C 'me@laptop'

Ed25519 is the modern default — small, fast, secure. RSA 4096 is the fallback for systems too old to know ed25519. Accept the default path (~/.ssh/id_ed25519) and set a passphrase.

Copy your public key to a server

ssh-copy-id user@server      # appends to remote ~/.ssh/authorized_keys
# If ssh-copy-id is missing on macOS
cat ~/.ssh/id_ed25519.pub | ssh user@server 'mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys'

ssh-agent — type the passphrase once

The agent caches your unlocked private key in memory. With it, you type the passphrase once per session and ssh / scp / git all use the key transparently.

eval "$(ssh-agent -s)"
ssh-add --apple-use-keychain ~/.ssh/id_ed25519   # macOS — store in Keychain
ssh-add -l                                       # list loaded keys

macOS auto-starts the agent. Add UseKeychain yes and AddKeysToAgent yes in ~/.ssh/config under Host * to make passphrase prompts a one-time annoyance.

Permissions

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519 ~/.ssh/config
chmod 644 ~/.ssh/id_ed25519.pub ~/.ssh/known_hosts

If anything is more permissive, ssh refuses the key.

Reduce private-key use paths instead of copying keys

Give each device its own key pair and manage permissions per public key on the server. Revocation and attribution are then clearer. An agent does not expose decrypted key bytes as a file, but it can sign requests for authorized processes.

Encryption without host verification is incomplete

Blindly accepting the first fingerprint can create an encrypted connection to an attacker. Verify the host key through a separate trust path, and investigate reinstall or DNS changes before deleting a changed-key warning from known_hosts.

Code

Generate + deploy a key·bash

ssh-keygen -t ed25519 -C 'me@$(hostname -s)'
# Verify
cat ~/.ssh/id_ed25519.pub
# Push to a server
ssh-copy-id user@server.example.com
# Test
ssh user@server.example.com 'echo ok'

macOS-friendly ssh config block·bash

cat >> ~/.ssh/config <<'EOF'
Host *
  UseKeychain yes
  AddKeysToAgent yes
  IdentitiesOnly yes
  ServerAliveInterval 60
EOF
chmod 600 ~/.ssh/config