ssh keys

Typing your password every single time you connect gets old fast, and it gets worse once you start copying files back and forth. The better way is an ssh key pair.

A key pair is two matching files. The private key stays on your laptop and is yours alone. The public key is the half you hand out, and you put a copy on every server you want to log in to. The server uses the public key to check that you hold the matching private one. The private key never leaves your machine and is never sent to the server.

Make a pair with ssh-keygen:

$ ssh-keygen -t ed25519

It asks where to save the key, and the default (~/.ssh/id_ed25519) is fine. Then it asks for a passphrase. It is tempting to leave it empty, but a passphrase means that someone who copies your private key still cannot use it. Your system will usually remember the passphrase for you after the first use each session, so you are not typing it constantly.

You now have two files:

~/.ssh/id_ed25519       your private key, keep it secret
~/.ssh/id_ed25519.pub   your public key, safe to share

Copy the public half to the server:

$ ssh-copy-id pete@server.example.org

This asks for your password one last time, then appends your public key to a file on the server called ~/.ssh/authorized_keys. Any key listed in that file is allowed to log in as you.

Windows does not come with ssh-copy-id. You can do the same thing by hand from PowerShell, which is worth reading anyway, because it shows exactly what ssh-copy-id does:

$ type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh pete@server.example.org "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

From now on:

$ ssh pete@server.example.org

goes straight in.

If it still asks for a password, the usual cause is permissions. ssh deliberately refuses to use keys if the files are readable by other people, and it tends to fail quietly rather than explain itself. On the server, ~/.ssh should be 700 and authorized_keys should be 600:

$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/authorized_keys

If you have several servers, or your username differs from machine to machine, you can write it all down once in ~/.ssh/config on your laptop:

Host work
    HostName server.example.org
    User pete

Now ssh work is enough. That short name works with scp and rsync too, and, as you will see in the next lesson, with VS Code.