5.4.2. SSH Keys, Signing, and Repository Management

SSH Key-Based Authentication:

# Generate SSH key pair
ssh-keygen -t ed25519 -C "alice@example.com"   # Ed25519 (preferred)
ssh-keygen -t rsa -b 4096 -C "alice@example.com"   # RSA 4096-bit (compatible)

# Key files
~/.ssh/id_ed25519        # Private key — protect this
~/.ssh/id_ed25519.pub    # Public key — share this
~/.ssh/authorized_keys   # Remote: put public keys here for access
~/.ssh/config            # SSH client config (host aliases, key selection)
~/.ssh/known_hosts       # Remote host fingerprints (auto-populated)

# Copy public key to remote
ssh-copy-id alice@server.example.com
# Or manually: cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys on remote

# ~/.ssh/config example
Host prod-web
  HostName 203.0.113.10
  User alice
  IdentityFile ~/.ssh/id_ed25519
  Port 2222

# SSH agent — avoid re-entering passphrase
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh-add -l                       # List keys in agent

# SSH tunneling
ssh -L 8080:db.internal:5432 jumphost  # Forward local 8080 to db:5432 via jumphost
ssh -R 9000:localhost:9000 server      # Reverse tunnel (expose local port on remote)
ssh -D 1080 server                     # SOCKS5 proxy

Key Permissions (critical):

chmod 700 ~/.ssh                  # Only owner can access
chmod 600 ~/.ssh/id_ed25519       # Only owner can read private key
chmod 644 ~/.ssh/id_ed25519.pub   # Anyone can read public key
chmod 600 ~/.ssh/authorized_keys  # Only owner can read

SSH will refuse to use a private key with insecure permissions (too-open), producing a "WARNING: UNPROTECTED PRIVATE KEY FILE!" error.

⚠️ Exam Trap: Ed25519 is the modern preferred key type — it's faster and more secure than RSA while using shorter keys. However, some older SSH servers don't support it; RSA 4096 is the fallback. The exam may test key type selection. Never use DSA or RSA-1024 — these are cryptographically broken.

Reflection Question: A junior admin reports that ssh server prompts for a password even though they "set up SSH keys." What are the three most likely configuration problems and how would you diagnose each?