安全 Shell 密钥管理

SSH keys are a secure way to log into a remote server without needing a password. Think of them as a digital key and lock system.

• They provide stronger security than traditional passwords.
• They offer convenience by enabling passwordless logins.
• This lesson will guide you through setting them up.

An SSH key system uses two parts: a public key and a private key.

• Your private key stays on your local computer and must be kept secret. Never share it!
• Your public key can be freely shared. You place it on any server you want to connect to.
• When you try to connect, the server uses your public key to verify your private key, allowing access.

You create an SSH key pair using the ssh-keygen command in your terminal.

By default, it creates keys in the ~/.ssh/ directory (a hidden folder in your home directory). The most common key type is RSA.

You'll be prompted for a passphrase. This adds an extra layer of security to your private key, encrypting it. It's highly recommended!

Let's generate an RSA key pair. When prompted, you can press Enter to use default file locations and choose a strong passphrase (or leave it empty for no passphrase, though not recommended for security).

After running ssh-keygen, you'll find two new files in your ~/.ssh/ directory:

• id_rsa: This is your private key. Keep it safe and never share it!
• id_rsa.pub: This is your public key. You'll copy this to remote servers.

The command also shows a key fingerprint, a unique identifier for your key pair.

To enable passwordless login, your public key needs to be on the remote server. The easiest way to do this is with the ssh-copy-id command.

It automatically appends your public key to the ~/.ssh/authorized_keys file on the server. You'll need to enter the server's password just this one time.

If ssh-copy-id isn't available on your system, you can manually copy your public key. This involves reading your local public key and piping it to the remote server via SSH, appending it to the authorized_keys file.

Make sure the .ssh directory exists and has correct permissions on the server (chmod 700 ~/.ssh).

Once your public key is on the server, try logging in. If you set a passphrase, you'll be prompted for it. If not, you should connect directly without any password prompts!

This confirms that your SSH key authentication is working correctly.

If your private key has a passphrase, you'll be asked for it every time you connect. The SSH agent helps by storing your decrypted private key in memory.

• Start the agent: eval "$(ssh-agent -s)"
• Add your key: ssh-add ~/.ssh/id_rsa (enter passphrase once)

Now you can connect multiple times without re-entering your passphrase until the agent restarts.

Which of the following files contains your public key and is safe to share with remote servers?

You've learned how to set up and manage SSH key pairs for secure, passwordless authentication.

• Generate keys with ssh-keygen.
• Understand private (id_rsa) and public (id_rsa.pub) keys.
• Copy public keys to servers using ssh-copy-id or manually.
• Use ssh-agent and ssh-add for passphrase convenience.

SSH keys are a fundamental tool for efficient and secure remote access in Linux!