SSH public-key authentication

Mental model

The private key remains on the client. The server stores the public key in authorized_keys. During authentication the client signs session-specific data; the server verifies the signature.

Create an Ed25519 key

ssh-keygen -t ed25519 -a 64 -f ~/.ssh/id_ed25519

Copy public key

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

Inspect verbose authentication

ssh -vv user@server

Safety

Encrypt private keys with a passphrase; restrict file permissions; use an agent when appropriate. Never publish a private key.