Key-based authentication in Linux CLI - Commands & Configuration

Introduction

Key-based authentication lets you log into a remote server without typing a password every time. It uses a pair of keys: one you keep safe on your computer and one you put on the server. This makes logging in faster and more secure.

When you want to connect to a remote server repeatedly without entering your password each time

When you want to improve security by avoiding password-based logins

When automating scripts that need to access remote servers securely

When managing multiple servers and want a simple way to access them

When you want to disable password login to prevent unauthorized access

Commands

This command creates a new SSH key pair using the ed25519 algorithm. The private key is saved to ~/.ssh/id_ed25519 and the public key to ~/.ssh/id_ed25519.pub. The -N "" means no passphrase is set, so no password is needed to use the key.

Terminal

ssh-keygen -t ed25519 -C "my-key" -f ~/.ssh/id_ed25519 -N ""

Expected Output

Generating public/private ed25519 key pair.

Your identification has been saved in /home/user/.ssh/id_ed25519

Your public key has been saved in /home/user/.ssh/id_ed25519.pub

The key fingerprint is:

ed25519 SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX my-key

The key's randomart image is:

+--[ED25519 256]--+

|      .o+o.      |

|     . +o+o      |

|    . . +.o      |

|     . . o .     |

|      S   .      |

|                 |

|                 |

|                 |

|                 |

+----[SHA256]-----+

→

-t - Specifies the type of key to create (ed25519 is modern and secure)

→

-f - Specifies the file name to save the private key

→

-N - Sets the passphrase for the key (empty means no passphrase)

This command copies your public key to the remote server's authorized keys file. This allows the server to recognize your key and let you log in without a password.

Terminal

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@remote-server

Expected Output

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh user@remote-server"

and check to make sure that only the key(s) you wanted were added.

→

-i - Specifies the public key file to copy

This command connects you to the remote server using SSH. Because your public key is on the server, it will let you in without asking for a password.

Terminal

ssh user@remote-server

Expected Output

Welcome to Ubuntu 22.04 LTS (GNU/Linux 5.15.0-50-generic x86_64)



user@remote-server:~$

Key Concept

If you remember nothing else from this pattern, remember: your private key stays on your computer and your public key goes on the server to enable passwordless, secure login.

Common Mistakes

Not setting correct permissions on ~/.ssh or authorized_keys

SSH refuses to use keys if permissions are too open, causing login failures

Set ~/.ssh directory to 700 and authorized_keys file to 600 on the server

Copying the private key instead of the public key to the server

Private keys must never leave your computer; copying it to the server breaks security and won't work

Always copy the public key file (ending with .pub) to the server

Using ssh-copy-id without specifying the correct user or server

The key won't be added to the right place, so passwordless login fails

Double-check the username and server address before running ssh-copy-id

Summary

Generate an SSH key pair on your local machine with ssh-keygen.

Copy the public key to the remote server using ssh-copy-id.

Connect to the remote server with ssh to log in without a password.

Practice

1. What is the main purpose of key-based authentication in SSH?

easy

A. To encrypt files on the local computer

B. To allow secure login without typing a password every time

C. To speed up the internet connection

D. To create a backup of the server data

Solution

1. Step 1: Understand key-based authentication

   Key-based authentication uses a pair of keys to allow login without passwords.

2. Step 2: Identify the main benefit

   This method lets users connect securely without typing passwords each time.

3. Final Answer:

   To allow secure login without typing a password every time -> Option B

4. Quick Check:

   Key-based authentication = passwordless secure login [OK]

Hint: Key-based auth means no password typing needed [OK]

Common Mistakes:

• Confusing key-based auth with file encryption
• Thinking it speeds up internet
• Believing it backs up data

2. Which command correctly generates a new SSH key pair?

easy

A. ssh-keygen

B. ssh-copy-id

C. ssh-add

D. ssh-connect

Solution

1. Step 1: Identify the key generation command

   The command ssh-keygen creates a new SSH key pair.

2. Step 2: Differentiate from other commands

   ssh-copy-id copies keys, ssh-add adds keys to agent, ssh-connect is invalid.

3. Final Answer:

   ssh-keygen -> Option A

4. Quick Check:

   Generate keys = ssh-keygen [OK]

Hint: ssh-keygen always creates keys [OK]

Common Mistakes:

• Using ssh-copy-id to generate keys
• Confusing ssh-add with key creation
• Typing a non-existent ssh-connect command

3. What will happen if you run ssh-copy-id user@server after generating your SSH keys?

medium

A. The SSH service on the server restarts

B. Your private key is copied to the server

C. The server's keys are copied to your local machine

D. Your public key is copied to the server for passwordless login

Solution

1. Step 1: Understand ssh-copy-id purpose

   This command copies your public key to the server's authorized keys file.

2. Step 2: Identify what is copied

   Only the public key is copied, enabling passwordless login; private keys stay local.

3. Final Answer:

   Your public key is copied to the server for passwordless login -> Option D

4. Quick Check:

   ssh-copy-id copies public key to server [OK]

Hint: ssh-copy-id copies public key, not private [OK]

Common Mistakes:

• Thinking private key is copied
• Believing server keys copy locally
• Assuming ssh-copy-id restarts SSH

4. You tried to connect with SSH key authentication but still get a password prompt. Which is the most likely cause?

medium

A. The public key was not copied to the server

B. The private key file is missing on the server

C. The SSH server is turned off

D. The username is incorrect

Solution

1. Step 1: Check key placement

   If the public key is not on the server, SSH cannot authenticate without a password.

2. Step 2: Understand private key location

   The private key stays on the client, so missing it on the server is irrelevant.

3. Final Answer:

   The public key was not copied to the server -> Option A

4. Quick Check:

   Missing public key on server = password prompt [OK]

Hint: Public key must be on server for key login [OK]

Common Mistakes:

• Looking for private key on server
• Assuming SSH server off causes password prompt
• Blaming wrong username without checking keys

5. You want to automate SSH login to multiple servers without passwords. Which sequence of commands is correct?

hard

A. ssh user@server -> ssh-copy-id user@server -> ssh-keygen

B. ssh-copy-id user@server -> ssh-keygen -> ssh user@server

C. ssh-keygen -> ssh-copy-id user@server -> ssh user@server

D. ssh user@server -> ssh-keygen -> ssh-copy-id user@server

Solution

1. Step 1: Generate SSH keys first

   Use ssh-keygen to create your key pair locally.

2. Step 2: Copy public key to server

   Use ssh-copy-id user@server to add your public key to the server.

3. Step 3: Connect without password

   Now ssh user@server logs in using the key without asking for a password.

4. Final Answer:

   ssh-keygen -> ssh-copy-id user@server -> ssh user@server -> Option C

5. Quick Check:

   Generate keys, copy key, then connect [OK]

Hint: Generate keys first, then copy, then connect [OK]

Common Mistakes:

• Copying keys before generating them
• Trying to connect before copying keys
• Mixing command order