[Zero Two]

SSH password authentication is insecure and inconvenient. Key-based auth is more secure and faster once set up. Here's everything you need.

Generate a key pair

Code:

ssh-keygen -t ed25519 -C "your_comment_here"
# ed25519 is preferred over RSA - shorter keys, faster, more secure
# Add a passphrase when prompted - protects the key if your machine is compromised

This creates ~/.ssh/id_ed25519 (private - never share this) and ~/.ssh/id_ed25519.pub (public - safe to share).

Copy your public key to a server

Code:

ssh-copy-id user@server
# Or manually:
cat ~/.ssh/id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Disable password auth on the server (do this after confirming keys work)

Code:

# In /etc/ssh/sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes

sudo systemctl restart sshd

SSH config file (~/.ssh/config) - underused and very useful

Code:

Host myserver
    HostName 192.168.1.100
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60

Host bastion
    HostName bastion.example.com
    User deploy
    ForwardAgent yes

Host internal
    HostName 10.0.0.50
    User admin
    ProxyJump bastion   # connect via bastion host

With this config, ssh myserver connects without typing IP, username, or specifying the key.

ssh-agent for passphrase convenience

Code:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
# Now the passphrase is cached for the session

On Mac: add UseKeychain yes and AddKeysToAgent yes to your SSH config and the passphrase saves to Keychain.

Security checklist:

• Use ed25519, not RSA 2048
  
• Use a passphrase on the private key
  
• Disable password auth on servers you control
  
• Never put private keys on servers (use agent forwarding or ProxyJump instead)
  
• Rotate keys if a machine is compromised