Skip to main content

SSH & Server Authentication

A. What Is SSH?​

SSH (Secure Shell) is used to securely connect to and control a remote server.

In this course, SSH is used to connect from our local computer to the server we created on DigitalOcean.

Instead of using password authentication, the course uses an SSH key pair.

Key idea: SSH provides a secure way to remotely connect to and interact with a server.

B. Public & Private Key Pair​

SSH uses a key pair consisting of:

  • Public key
  • Private key

The public key can be shared with other people or services.

The instructor says you could even:

  • Give it to someone
  • Publish it online
  • Post it publicly

The private key, however, should only be known by you.

Key idea: The public key can be shared, but the private key must remain private.

C. How SSH Public-Key Authentication Works​

SSH public-key authentication uses digital signatures, not a process where the server encrypts a login message with the public key and the client decrypts it with the private key.

Before connecting, the server stores a copy of the user's public key, usually in ~/.ssh/authorized_keys. The private key remains on the user's local computer.

During authentication:

  1. The client tells the server which public key it wants to use.
  2. The server checks whether that public key is authorised for the account.
  3. The client uses the private key to sign data that is specific to the SSH session.
  4. The server uses the stored public key to verify the signature.
  5. If the signature is valid, the client has proved that it possesses the private key without sending the private key to the server.

SSH also establishes an encrypted connection to protect data sent between the client and server. That encrypted transport is related to, but separate from, proving the user's identity with a key pair.

Key idea: The private key signs proof on the local computer, while the server uses the public key to verify it. The private key is never sent to the server.

D. Creating an SSH Key Pair​

SSH keys can be created using:

ssh-keygen

The instructor first moves into the SSH directory:

cd ~/.ssh

Then creates a new key using:

ssh-keygen

The RSA key name mentioned in the course is:

id_rsa

For a new key, Ed25519 is a common modern choice:

ssh-keygen -t ed25519 -C "your-email@example.com"

You can give the key a descriptive name when prompted.

The instructor creates a separate key for the course so that it is easier to identify.

Key idea: ssh-keygen generates the SSH key pair used for authentication.

E. SSH Key Files​

SSH keys are commonly stored inside:

~/.ssh/

The . in .ssh means it is a hidden directory.

You can display hidden files with:

ls -la

After generating an SSH key pair, you should have two related files.

For example:

~/.ssh/

fsfe
fsfe.pub

The file without .pub is the:

fsfe
↓
Private Key

The file ending in .pub is the:

fsfe.pub
↓
Public Key

Therefore:

fsfe       → Private Key → DO NOT SHARE
fsfe.pub   → Public Key  → Can be shared

The instructor emphasizes:

If it doesn't say .pub, don't share it.

Key idea: .pub identifies the public key; the corresponding file without .pub is the private key.

F. SSH Key Passphrase​

When creating an SSH key, ssh-keygen can ask you to add a passphrase.

The passphrase provides another layer of protection for your private key.

Why?

Because someone might gain access to your computer and find your private key.

The instructor skips the passphrase in the demonstration for convenience, but says that normally you should use one.

Key idea: A passphrase helps protect your private key if someone gains access to the machine where it is stored.

G. Adding the Public Key to DigitalOcean​

After generating the SSH key pair, the next step is to give the server the public key.

First, display the public key:

cat <key-name>.pub

For example:

cat fsfe.pub

Then copy the entire public key.

When creating the server, choose:

Then:

  1. Select New SSH Key
  2. Paste the public key
  3. Give the key a recognizable name
  4. Select the key for the server

The private key remains on your local computer.

Key idea: Give the server your public key while keeping the private key on your own machine.

H. Connecting to the Server with SSH​

Once the server is running, DigitalOcean provides an IP address.

To connect, the instructor uses SSH and specifies the private key.

The general structure is:

ssh -i <private-key> root@<server-ip>

For example:

ssh -i ~/.ssh/fsfe root@123.123.123.123

ssh​

Starts an SSH connection.

-i​

Specifies the identity file to use.

~/.ssh/fsfe​

The location of the private key.

Remember:

fsfe       ← use this
fsfe.pub   ← NOT this

root@<IP>​

Specifies:

User   → root
Host   → Server IP address

Together:

Once authentication succeeds, you are logged into the remote Ubuntu server.

Logging in as root may be appropriate for initial server setup, but routine administration should normally use a separate non-root account with sudo. After confirming that the new account and SSH key work, the server can also be configured to restrict direct root login and disable password authentication.

Key idea: ssh -i tells SSH which private key to use when authenticating to the remote server.

I. Host Verification & known_hosts​

The first time you connect to a server, SSH may show a warning asking whether you trust the host.

Conceptually:

After you confirm the connection, SSH remembers the server.

This information is stored in:

~/.ssh/known_hosts

The known_hosts file keeps a history of hosts your machine has previously connected to.

On future connections, SSH can compare the server against the information it previously stored.

If SSH unexpectedly asks you to verify a server again, the instructor recommends checking what changed before blindly accepting it.

Key idea: known_hosts helps SSH remember and verify servers you've connected to before.

J. SSH Config & Keychain​

Typing the full command every time can become repetitive:

ssh -i ~/.ssh/fsfe root@<server-ip>

The instructor therefore configures SSH so it can automatically use the appropriate identity.

SSH configuration lives under:

~/.ssh/

and can use a:

config

file.

The configuration can specify things such as the default identity file.

This means you don't always need to manually specify:

-i ~/.ssh/fsfe

macOS Keychain​

On macOS, the instructor also demonstrates adding the private key to the system Keychain using ssh-add.

The purpose is convenience:

After configuration, the connection can become simpler:

ssh root@<server-ip>

instead of:

ssh -i ~/.ssh/fsfe root@<server-ip>

Key idea: SSH config and the Keychain/agent can remember which private key to use, reducing repetitive commands.

K. Managing Multiple SSH Keys​

You can create multiple SSH keys.

For example:

~/.ssh/

personal
personal.pub

work
work.pub

fsfe
fsfe.pub

This is useful when different servers or services use different keys.

However, the instructor warns:

"Just don't lose track of them because you'll be like, which one is it?"

Give your keys recognizable names and remember what each key is associated with.

If a key is configured incorrectly, you can:

  • Delete it
  • Re-add it
  • Create another key

Key idea: Multiple SSH keys are fine, but good naming and organization become important.

SSH Authentication Flow​

The complete process from this section is:

Or practically:

Most Important Concepts​

  • SSH

    • Securely connects your local machine to a remote server.

  • SSH Key Pair

    • Consists of a public key and private key.

  • Public Key

    • Can be shared and added to the server.

  • Private Key

    • Must remain private.

  • ssh-keygen

    • Generates an SSH key pair.

  • .pub

    • Indicates the public key file.

  • ssh -i

    • Specifies which private key SSH should use.

  • known_hosts

    • Stores information about servers you've previously connected to.

  • SSH Config / Keychain

    • Helps SSH automatically find the appropriate private key.

Core idea: Keep the private key on your local machine, give the public key to the server, and use SSH to securely authenticate and connect to that server.