Understanding SSH and Key-Based Authentication

Secure Shell (SSH) is a protocol that lets you securely access and manage remote servers. Using SSH, you can log in, execute commands, and transfer files between systems over encrypted connections.

Basic SSH Connection

To connect to a remote server with SSH, use:

ssh username@remote_host

• ssh: the command to start an SSH session;
• username: the user account on the remote system;
• remote_host: the IP address or domain name of the remote server.

You will be prompted to enter the password for the specified user. This method is secure but can be inconvenient and less safe for automation.

Key-Based Authentication

Key-based authentication improves security and streamlines access by using a pair of cryptographic keys instead of passwords.

Generating an SSH Key Pair

Create a new SSH key pair on your local machine:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

• ssh-keygen: generates SSH key pairs;
• -t rsa: selects the RSA algorithm;
• -b 4096: sets the key length to 4096 bits for stronger security;
• -C: adds a label to the key for identification.

Follow the prompts to save the key files (by default in ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub) and set a passphrase for extra protection.

Copying Your Public Key to the Remote Server

To enable key-based authentication, transfer your public key to the remote server:

ssh-copy-id username@remote_host

• ssh-copy-id: copies your public key to the remote server's ~/.ssh/authorized_keys file;
• You must enter the remote user's password one last time to complete this step.

After this, SSH will use your private key for authentication, and you will not be prompted for the password again.

Verifying Key-Based Login

Test your new setup:

ssh username@remote_host

If configured correctly, you will connect without entering a password, unless you set a passphrase for your private key.

Key File Permissions

SSH requires strict permissions for key files. Set them as follows:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

• 700 for the .ssh directory: only you can access it;
• 600 for private keys and authorized_keys: readable and writable only by you;
• 644 for public keys: readable by anyone, but writable only by you.

Key-based authentication is essential for automating remote administration tasks in DevOps workflows.