SSH Keys & Agents

Why keys beat passwords

Password authentication sends a secret over the network every login. Brute-force bots hammer port 22 worldwide. Public-key authentication uses cryptography: the server holds your public key; only your private key can prove you are Marcus.

Workshop Co. disables password login on production servers. Marcus's laptop holds the only private key — with a passphrase — for admin access.

Generate a key pair

# On Marcus's MacBook — Ed25519 recommended
ssh-keygen -t ed25519 -C "marcus@workshopco.ca" -f ~/.ssh/workshopco_ed25519

# Passphrase: yes, always — protects key if laptop stolen

This creates:

• ~/.ssh/workshopco_ed25519 — private key (never share, chmod 600)
• ~/.ssh/workshopco_ed25519.pub — public key (goes on servers)

Install public key on a server

# One-time, if password login still enabled on bastion
ssh-copy-id -i ~/.ssh/workshopco_ed25519.pub marcus@bastion.workshopco.ca

# Manual method — append pub key to server
mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-ed25519 AAAA... marcus@workshopco.ca" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Worked example — Workshop Co. bastion

Marcus adds his key to the bastion LXC (CT 200 renamed to bastion role) and each VM's deploy user:

SSH agent

Typing a passphrase every connection is tedious. The ssh-agent holds decrypted keys in memory:

# macOS — add key and store in Keychain
ssh-add --apple-use-keychain ~/.ssh/workshopco_ed25519

# Linux — start agent and add
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/workshopco_ed25519

# List loaded keys
ssh-add -l

ssh -i ~/.ssh/lab_ed25519 user@hostname