Key-based authentication in Linux CLI - Deep Dive

Overview - Key-based authentication

What is it?

Key-based authentication is a way to securely log into a remote computer without typing a password every time. Instead, it uses a pair of keys: one private and one public. The private key stays on your computer, and the public key is placed on the remote computer. When you connect, the remote computer checks your private key against the public key to let you in.

Why it matters

This method makes logging in safer and faster. Without it, you would have to type your password every time, which can be risky if someone watches or steals it. Key-based authentication prevents hackers from guessing or stealing passwords, making remote access much more secure.

Where it fits

Before learning this, you should know basic command-line usage and how to connect to remote servers using passwords. After mastering key-based authentication, you can explore advanced security setups like multi-factor authentication or automated scripts that use keys for secure access.

Mental Model

Core Idea

Key-based authentication uses a matched pair of secret and public keys to prove your identity without sending a password.

Think of it like...

It's like having a special lock (public key) on a door that only opens with your unique key (private key) that you keep safe in your pocket.

Your Computer (Private Key) ───▶ Remote Server (Public Key)
       │                             │
       │  Connects and proves       │
       │  identity without password │
       ▼                             ▼
  Access granted if keys match

Build-Up - 7 Steps

1

Foundation

Understanding SSH and Password Login

Concept: Learn how SSH works with passwords to connect to remote servers.

SSH (Secure Shell) lets you connect to another computer securely over a network. Normally, you type a username and password to log in. This password is sent securely but typing it every time can be slow and risky if someone watches.

Result

You can connect to a remote server by typing your password each time.

Knowing how password login works helps you appreciate why key-based authentication improves security and convenience.

2

Foundation

What Are SSH Keys?

Concept: Introduce the idea of a key pair: private and public keys.

SSH keys come in pairs. The private key stays on your computer and must be kept secret. The public key can be shared and placed on servers you want to access. Together, they allow secure login without passwords.

Result

You understand the two parts of key-based authentication and their roles.

Recognizing the roles of private and public keys is essential to grasp how authentication works without passwords.

3

Intermediate

Generating SSH Key Pairs

🤔Before reading on: do you think the private key should ever leave your computer? Commit to your answer.

Concept: Learn how to create your own SSH key pair safely.

Use the command 'ssh-keygen' to create a key pair. It asks where to save the keys and if you want a passphrase for extra security. The private key stays on your machine, and the public key is saved separately.

Result

You have a private key file and a public key file ready to use.

Understanding key generation ensures you can create secure keys and keep your private key safe.

4

Intermediate

Installing Public Key on Remote Server

🤔Before reading on: do you think you need to copy the private key to the server? Commit to your answer.

Concept: Learn how to place your public key on the server to allow key-based login.

Copy your public key to the remote server's '~/.ssh/authorized_keys' file. This tells the server to trust your private key. You can use 'ssh-copy-id user@server' to do this easily.

Result

The server recognizes your private key and allows login without a password.

Knowing where and how to install the public key is crucial for setting up key-based authentication.

5

Intermediate

Connecting Using Key-based Authentication

Concept: Use SSH to connect without typing a password after setup.

Run 'ssh user@server'. SSH uses your private key to prove your identity. If the server finds the matching public key, it logs you in without asking for a password.

Result

You connect to the server quickly and securely without entering a password.

Seeing key-based login in action shows the practical benefit of this method.

6

Advanced

Securing Private Keys with Passphrases

🤔Before reading on: do you think adding a passphrase to your private key makes login slower or safer? Commit to your answer.

Concept: Add a passphrase to your private key to protect it if stolen.

When generating keys, you can add a passphrase. This means even if someone steals your private key file, they cannot use it without the passphrase. You type the passphrase once per session.

Result

Your private key is protected by an extra secret, improving security.

Understanding passphrases balances convenience and security for private keys.

7

Expert

Using SSH Agent for Key Management

🤔Before reading on: do you think SSH agent stores your private key or just the passphrase? Commit to your answer.

Concept: Use ssh-agent to hold decrypted private keys in memory for easy repeated login.

ssh-agent runs in the background and stores your unlocked private keys. You enter the passphrase once, and ssh-agent provides the key to SSH commands automatically. This avoids typing passphrases repeatedly.

Result

You can connect to multiple servers smoothly without typing passphrases each time.

Knowing how ssh-agent works improves workflow and security by managing keys efficiently.

Under the Hood

When you connect, your SSH client uses your private key to create a digital signature. The server checks this signature against your stored public key. If they match, it proves you have the private key without sending it over the network. This uses cryptographic algorithms like RSA or Ed25519 to ensure security.

Why designed this way?

Passwords can be guessed or stolen, so key pairs were designed to avoid sending secrets over the network. Public-key cryptography allows proving identity without sharing private secrets. This design balances security and convenience, and evolved from early cryptographic research to practical remote access needs.

┌───────────────┐       ┌─────────────────────┐
│ Client (You)  │       │ Server (Remote Host) │
│               │       │                     │
│ Private Key   │──────▶│ Public Key stored    │
│ Creates       │       │ in ~/.ssh/authorized_keys
│ Signature     │       │                     │
│               │       │ Verifies Signature  │
└───────────────┘       └─────────────────────┘
          │                        ▲
          └───────── Network ──────┘

Myth Busters - 4 Common Misconceptions

Quick: Do you think the private key should be shared with the server? Commit to yes or no.

Common Belief: You must copy your private key to every server you want to access.

Reality: Only the public key is copied to the server; the private key stays secret on your computer.

Why it matters: Sharing the private key risks it being stolen, which breaks your security completely.

Quick: Do you think key-based authentication means you never need passwords again? Commit to yes or no.

Common Belief: Once set up, passwords are never used or needed again.

Reality: Passwords may still be required for other services or if the private key has a passphrase.

Why it matters: Assuming no passwords are needed can lead to confusion when other authentication prompts appear.

Quick: Do you think anyone with the public key can log in? Commit to yes or no.

Common Belief: If someone has your public key, they can access your server.

Reality: The public key alone cannot grant access; only the matching private key can authenticate.

Why it matters: Misunderstanding this can cause unnecessary fear or improper handling of public keys.

Quick: Do you think adding a passphrase to your private key makes it impossible to automate logins? Commit to yes or no.

Common Belief: Passphrases prevent any automated or script-based logins.

Reality: Tools like ssh-agent allow automated logins while keeping passphrases secure.

Why it matters: Believing this limits secure automation and leads to weaker security choices.

Expert Zone

1

Some key types like Ed25519 offer better security and performance than older RSA keys, but not all servers support them yet.

2

SSH config files can simplify managing multiple keys and servers by specifying which key to use per host.

3

Improper permissions on ~/.ssh or authorized_keys files can silently break key-based authentication, causing confusion.

When NOT to use

Key-based authentication is not suitable when you cannot securely store private keys, such as on shared or untrusted machines. In such cases, one-time passwords or multi-factor authentication may be better.

Production Patterns

In real systems, key-based authentication is combined with centralized user management, automated key rotation, and monitoring. SSH agents and config files help developers and admins manage many servers efficiently and securely.

Connections

Public-key cryptography

Key-based authentication is a practical application of public-key cryptography.

Understanding the math behind public-key cryptography deepens trust in how keys prove identity without sharing secrets.

Password managers

Both manage secrets securely but password managers store passwords, while key-based authentication uses cryptographic keys.

Knowing how password managers protect secrets helps appreciate why private keys must be kept safe and encrypted.

Physical lock and key systems

Key-based authentication mimics physical locks where only the correct key opens the lock.

This connection helps understand why losing a private key is like losing a physical key and why it must be protected.

Common Pitfalls

#1 Copying the private key to the server for convenience.

Wrong approach:

scp ~/.ssh/id_rsa user@server:~/.ssh/id_rsa

Correct approach:

ssh-copy-id user@server

Root cause:

Misunderstanding that only the public key should be on the server and private keys must remain secret.

#2 Setting wrong permissions on ~/.ssh directory and files.

Wrong approach:

chmod 777 ~/.ssh
chmod 666 ~/.ssh/authorized_keys

Correct approach:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Root cause:

Not knowing SSH requires strict permissions to trust key files, causing silent failures.

#3 Not using ssh-agent and typing passphrase every time.

Wrong approach:

ssh user@server (and typing passphrase repeatedly)

Correct approach:

eval $(ssh-agent)
ssh-add ~/.ssh/id_rsa
ssh user@server

Root cause:

Unawareness of ssh-agent's role in improving usability and security.

Key Takeaways

Key-based authentication uses a pair of keys to securely prove your identity without sending passwords.

The private key must always stay secret on your computer; only the public key goes to the server.

Generating, installing, and using keys correctly prevents many common security risks of password login.

Adding a passphrase and using ssh-agent balances security with convenience for daily use.

Understanding file permissions and key management is essential to avoid silent authentication failures.