How SSH key authentication works.
Public-key auth feels like magic — you put a file on a server and suddenly you can log in without a password. Underneath, it's a six-step handshake that proves you hold a secret without ever sending it across the wire.
How SSH key authentication works. Animated six-step handshake showing public/private key roles, challenge-response, signature verification, and channel establishment. Covers RHCSA EX200 security objectives.What actually happens between your laptop and the server when you type ssh user@host. Six steps that prove you hold a secret without sending it.
- ·Comfort with running ssh from a terminal at least once
- ·A rough sense that some encryption uses one key, some uses two
- ·Helpful: the SSH Key Setup tool on this site, if you haven't generated a key yet
Predict every message that crosses the wire during a key-auth login. Explain why the public key is safe to share and the private key isn't.
pace: 10 minutes
// arrows numbered to match lesson steps · steps 1 & 4 happen locally on each side, so only steps 2, 3, 5 and 6 appear as arrows crossing the wire.
Two halves of a math pair
An SSH key is two matching files. The private one stays on your laptop — keep it secret. The public one is safe to share, so you copy it onto every server you want to log in to. Anyone with the public key can CHECK a signature, but only the private key can MAKE one. That's the whole trick.
The private key never crosses the network. Not even once. The whole protocol is designed around proving possession of the private key by signing something a watcher can't replay — which is why pasting your private key into a chat or an email is a wipe-the-key incident, while pasting the public key is fine.
$ssh-keygen -t ed25519$ssh-keygen -t ed25519 -C label$ssh-copy-id user@host$ssh-add ~/.ssh/id_ed25519$ssh-add -l$ssh-add -D$ssh -v user@host$ssh-keygen -lf KEY$~/.ssh/id_ed25519$~/.ssh/id_ed25519.pub$~/.ssh/authorized_keys$~/.ssh/known_hosts$chmod 700 ~/.ssh$chmod 600 ~/.ssh/id_ed25519$/etc/ssh/sshd_config$PasswordAuthentication noWhy is it safe to paste your public key into a GitHub profile or send it in plaintext email?
Which file holds the PRIVATE key on your laptop?
Bob copies your ~/.ssh/authorized_keys file from the server to his laptop. Can he now log in as you?
What does ssh-agent do?
These aren't graded — they're just for active recall, which is what actually makes the lesson stick.
SSH Key Setup tool
Step-by-step walk-through for generating your first key with ssh-keygen, copying the public half to a server with ssh-copy-id, and configuring ~/.ssh/config so you never type the full host again.