SSH keys: what is the server actually checking?

The quick answer

The server verifies a signature made with the client's private key using a trusted public key. The private key is not sent to the server.

ssh -v user@server

What's going on?

The server verifies a signature made with the client's private key using a trusted public key. The private key is not sent to the server.

Understanding the underlying mechanism makes troubleshooting much easier than memorising a command in isolation.

Dig a little deeper

Check file permissions, authorized_keys, sshd effective settings and client debug output. An agent can hold keys without exposing the private key to the remote host.

Hands-on commands

Try these in a suitable test environment. Read each command before running it, especially if you have elevated privileges.

ssh -vv user@server
ssh-add -l
sudo sshd -T | grep -i pubkeyauthentication