Lesson 14 · Networking, scripting and internals

SSH and keys

SSH, the Secure Shell, lets you run commands on another computer over the network, with everything encrypted. Make a key pair with ssh-keygen, put the public half on a server with ssh-copy-id, then follow ssh ana@web1 step by step: the connection to port 22, the key exchange that builds a shared secret nobody else sees, the host key check, and a login where the private key signs but never leaves your laptop.

12 min10 steps5 questionsBeginner

Fig 14 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01ssh-keygen -t ed25519 writes id_ed25519 and id_ed25519.pub. Which one may you copy to servers and share?

The .pub file is the public key: it can only check signatures, so sharing it is safe. id_ed25519 is the private key; it stays on your laptop and should be readable only by you.

02What does ssh-copy-id ana@web1 change on the server?

ssh-copy-id logs in once (usually with the password) and appends your public key to ana's authorized_keys file. From then on sshd accepts a signature from the matching private key.

03During the key exchange, how do both sides end up with the same secret?

In a Diffie-Hellman style exchange such as curve25519-sha256, only public halves cross the network. Each side combines its own secret half with the other's public half, and both arrive at the same shared secret, which is never sent.

04The first time you connect, ssh shows a fingerprint and asks whether to continue. What is it checking?

The server signs the exchange with its host key. ssh has no record of it yet, so it asks you; if you answer yes it saves the key in ~/.ssh/known_hosts and checks it on every later visit.

05When you log in with a key, what proves to sshd that you hold the private key?

The signature covers the session identifier, so it is only valid for this connection. sshd verifies it with the public key it already has; the private key itself never leaves your laptop.

Key terms

Glossary

SSH: Secure Shell: a protocol and a set of programs for logging in to and running commands on another computer over an encrypted connection.
sshd: The SSH server program. It listens for connections, by default on TCP port 22.
Key pair: Two matching keys made together: a private key you keep secret, and a public key you may share. A signature made with the private key can be checked with the public key.
authorized_keys: A file on the server, ~/.ssh/authorized_keys, listing the public keys allowed to log in as that user, one per line.
known_hosts: A file on your laptop, ~/.ssh/known_hosts, that remembers the host key of every server you have accepted.
Host key: The server's own key pair. It signs the key exchange so you can tell you are talking to the real server.
Key exchange: The start of every SSH connection: both sides build the same secret from one-time public halves, and derive the keys that encrypt the session.
Fingerprint: A short hash of a public key (for example SHA256:…) that people can compare by eye. ssh-keygen -l prints it.

Fine print

Notes and sources

The terminal card shows only the commands. In real life ssh-keygen also asks where to save the key and for a passphrase, ssh-copy-id prints what it added, and the first ssh asks the fingerprint question shown in step 6.
The key exchange shown is curve25519-sha256 (RFC 8731). Since OpenSSH 10.0 the default is mlkem768x25519-sha256, which mixes in a post-quantum method, but the idea is the same: a shared secret that never crosses the network.
ssh-copy-id needs one password login to work. Once keys work, many admins turn password logins off in /etc/ssh/sshd_config (PasswordAuthentication no). Keep another way in before you change it, or you can lock yourself out.
Never copy or share the private key file. If it leaks, remove the matching line from authorized_keys on every server and make a new pair. A passphrase protects the file if someone copies it.
If a server you know shows a different host key, ssh refuses and prints a warning. It may be a reinstalled server, or someone in the middle: check before you trust the new key.

Quiz Unlocks after the last step.