SSH Basics: Keys and Agent

Why keys, not passwords

SSH keys replace passwords with cryptographic key pairs. The private key stays on your machine; the public key goes on every server you log into. The server checks that you hold the private key without ever seeing it. Faster, safer, scriptable.

Generate

ssh-keygen -t ed25519 -C 'me@laptop'

Ed25519 is the modern default — small, fast, secure. RSA 4096 is the fallback for systems too old to know ed25519. Accept the default path (~/.ssh/id_ed25519) and set a passphrase.

Copy your public key to a server

ssh-copy-id user@server      # appends to remote ~/.ssh/authorized_keys
# If ssh-copy-id is missing on macOS
cat ~/.ssh/id_ed25519.pub | ssh user@server 'mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys'

ssh-agent — type the passphrase once

The agent caches your unlocked private key in memory. With it, you type the passphrase once per session and ssh / scp / git all use the key transparently.

eval "$(ssh-agent -s)"
ssh-add --apple-use-keychain ~/.ssh/id_ed25519   # macOS — store in Keychain
ssh-add -l                                       # list loaded keys

macOS auto-starts the agent. Add UseKeychain yes and AddKeysToAgent yes in ~/.ssh/config under Host * to make passphrase prompts a one-time annoyance.

Permissions

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519 ~/.ssh/config
chmod 644 ~/.ssh/id_ed25519.pub ~/.ssh/known_hosts

If anything is more permissive, ssh refuses the key.

Code

Generate + deploy a key·bash

ssh-keygen -t ed25519 -C 'me@$(hostname -s)'
# Verify
cat ~/.ssh/id_ed25519.pub
# Push to a server
ssh-copy-id user@server.example.com
# Test
ssh user@server.example.com 'echo ok'

macOS-friendly ssh config block·bash

cat >> ~/.ssh/config <<'EOF'
Host *
  UseKeychain yes
  AddKeysToAgent yes
  IdentitiesOnly yes
  ServerAliveInterval 60
EOF
chmod 600 ~/.ssh/config

Why keys, not passwords

Generate

Copy your public key to a server

ssh-agent — type the passphrase once

Permissions

Code

External links

Exercise

Progress

Comments 0