Skip to content

Commit 3c49827

Browse files
committed
feat(ssh-guide): add SSH authentication guide for Git and servers
closes #33 CHANGES - SSH Authentication Guide (new) - Full workflow: check keys, generate Ed25519, add to ssh-agent - Use Case: Git hosting with URL rewriting (HTTPS URLs, SSH auth) - Use Case: Remote servers with ssh-copy-id and SCP file transfer - Troubleshooting: permission denied, agent persistence - CONTRIBUTING.md - Add Prerequisites section requiring SSH and GPG setup - Bump version to v2.2.0 - SECURITY.md - Add Development Security section with CIA triad table - Bump version to v1.1.0 - README.md - Add SSH to workflows list - human-guides/README.md - Add SSH guide to Use Cases list IMPACT - Contributors now required to have SSH and GPG configured - Security guidance includes development workflow best practices
1 parent 3eeb6dc commit 3c49827

6 files changed

Lines changed: 313 additions & 6 deletions

File tree

CONTRIBUTING.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,13 @@
44
55
How to contribute to `common-devx` - adding skills, guides, and templates.
66

7+
## Prerequisites
8+
9+
Before contributing, ensure you have:
10+
11+
- SSH key configured for GitHub access (see [`use-cases-ssh-authentication.md`](./human-guides/use-cases-ssh-authentication.md))
12+
- GPG key configured for commit signing (see [`use-cases-gpg-commit-signing.md`](./human-guides/use-cases-gpg-commit-signing.md))
13+
714
## Development Model
815

916
This repository uses **trunk-based development**:
@@ -105,4 +112,4 @@ Open a [GitHub issue](https://github.com/KemingHe/common-devx/issues).
105112

106113
---
107114

108-
> Contributing Guide v2.1.0 - KemingHe/common-devx
115+
> Contributing Guide v2.2.0 - KemingHe/common-devx

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ Available skills: commit messages, issues, PRs, meeting memos, READMEs, and more
2828

2929
Browse [`human-guides/`](./human-guides/README.md) for:
3030

31-
- Git, shell, and GPG workflows (`use-cases-*.md`)
31+
- Git, shell, SSH, and GPG workflows (`use-cases-*.md`)
3232
- Diagnostic procedures (`diagnosis-*.md`)
3333

3434
### For Projects

SECURITY.md

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Security Policy
22

3-
> **Last Updated**: 2026-02-05 by Keming He
3+
> **Last Updated**: 2026-02-06 by Keming He
44
55
Security considerations for using and contributing to common-devx.
66

@@ -25,6 +25,17 @@ When using skills from this repository:
2525
3. **Check for sensitive data** - Ensure no credentials, secrets, or PII are exposed
2626
4. **Validate links and paths** - Confirm references point to correct locations
2727

28+
## Development Security
29+
30+
Secure your development workflow with these practices:
31+
32+
| CIA Component | Practice | Guide |
33+
| :--- | :--- | :--- |
34+
| **Confidentiality** | SSH key authentication | [`use-cases-ssh-authentication.md`](./human-guides/use-cases-ssh-authentication.md) |
35+
| **Integrity** | GPG commit signing | [`use-cases-gpg-commit-signing.md`](./human-guides/use-cases-gpg-commit-signing.md) |
36+
37+
These guides apply to any Git-based workflow, not just this repository.
38+
2839
## Reporting Issues
2940

3041
### Content Problems
@@ -68,4 +79,4 @@ If you discover a security issue:
6879

6980
---
7081

71-
> Security Policy v1.0.0 - KemingHe/common-devx
82+
> Security Policy v1.1.0 - KemingHe/common-devx

human-guides/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ New types welcome - use descriptive prefixes that categorize the content.
2626
- [`use-cases-git.md`](./use-cases-git.md) - Git command-line workflows
2727
- [`use-cases-shell.md`](./use-cases-shell.md) - Shell operations
2828
- [`use-cases-gpg-commit-signing.md`](./use-cases-gpg-commit-signing.md) - GPG commit signing
29+
- [`use-cases-ssh-authentication.md`](./use-cases-ssh-authentication.md) - SSH authentication (Git + servers)
2930

3031
### Diagnosis
3132

human-guides/use-cases-gpg-commit-signing.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ Copy the entire output, including `-----BEGIN PGP PUBLIC KEY BLOCK-----` and `--
152152

153153
1. Go to [**GitHub Settings**](https://github.com/settings/) > [**SSH and GPG keys**](https://github.com/settings/keys)
154154
2. Click **New GPG key**
155-
3. Paste your public key
155+
3. Title: descriptive name (e.g., "[Color] MacBook Pro [YYYY]")
156156
4. Click **Add GPG key**
157157

158158
> [↑ Back to Table of Contents](#table-of-contents)
@@ -272,4 +272,4 @@ If the issue persists and you need to commit urgently, see [Skip Signing](#skip-
272272
273273
---
274274

275-
> Use Cases - GPG Commit Signing v1.0.0 - KemingHe/common-devx
275+
> Use Cases - GPG Commit Signing v1.0.1 - KemingHe/common-devx
Lines changed: 288 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,288 @@
1+
# Use Cases - SSH Authentication
2+
3+
> **Last Updated**: 2026-02-06 by Keming He
4+
5+
## Platform
6+
7+
> [!IMPORTANT]
8+
>
9+
> This guide is for **macOS / Linux** users with POSIX-compatible shell (sh, bash, zsh).
10+
>
11+
> For **Windows** users: See [GitHub: Connecting to GitHub with SSH](https://docs.github.com/en/authentication/connecting-to-github-with-ssh).
12+
13+
Authenticate to Git hosting services and remote servers using SSH keys.
14+
15+
## Table of Contents
16+
17+
- [Use Cases - SSH Authentication](#use-cases---ssh-authentication)
18+
- [Platform](#platform)
19+
- [Table of Contents](#table-of-contents)
20+
- [Why Use SSH Keys?](#why-use-ssh-keys)
21+
- [Check for Existing Keys](#check-for-existing-keys)
22+
- [Generate New Key](#generate-new-key)
23+
- [Generate Key](#generate-key)
24+
- [Add to ssh-agent](#add-to-ssh-agent)
25+
- [Use Case: Git Hosting](#use-case-git-hosting)
26+
- [Copy Public Key](#copy-public-key)
27+
- [Add Key to GitHub](#add-key-to-github)
28+
- [URL Rewriting](#url-rewriting)
29+
- [Test Connection](#test-connection)
30+
- [Use Case: Remote Servers](#use-case-remote-servers)
31+
- [Add Key to Host](#add-key-to-host)
32+
- [Connect](#connect)
33+
- [File Transfer (SCP)](#file-transfer-scp)
34+
- [Troubleshooting](#troubleshooting)
35+
- [Permission Denied](#permission-denied)
36+
- [Agent Issues](#agent-issues)
37+
38+
## Why Use SSH Keys?
39+
40+
- **Passwordless auth**: No prompts for git operations or server logins
41+
- **More secure**: Key-based authentication is stronger than passwords
42+
- **One setup, multiple uses**: Same key works for Git hosting, servers, and file transfer
43+
44+
> [↑ Back to Table of Contents](#table-of-contents)
45+
46+
---
47+
48+
## Check for Existing Keys
49+
50+
```shell
51+
ls -la ~/.ssh
52+
```
53+
54+
Look for files like `id_ed25519` and `id_ed25519.pub` (or `id_rsa`/`id_rsa.pub`). If you have a key pair, you can skip to [Add to ssh-agent](#add-to-ssh-agent).
55+
56+
> [↑ Back to Table of Contents](#table-of-contents)
57+
58+
---
59+
60+
## Generate New Key
61+
62+
### Generate Key
63+
64+
**Ed25519** (recommended - smaller, faster, more secure):
65+
66+
```shell
67+
ssh-keygen -t ed25519 -C "your-email@example.com"
68+
```
69+
70+
When prompted:
71+
72+
1. Press **Enter** to accept the default file location (`~/.ssh/id_ed25519`)
73+
2. Enter a passphrase (optional but recommended)
74+
75+
> [!TIP]
76+
>
77+
> **Passphrase adds security** - if your private key is compromised, the attacker still needs the passphrase. The ssh-agent caches it so you don't type it repeatedly.
78+
79+
For legacy systems that don't support Ed25519:
80+
81+
```shell
82+
ssh-keygen -t rsa -b 4096 -C "your-email@example.com"
83+
```
84+
85+
### Add to ssh-agent
86+
87+
The ssh-agent caches your key so you don't enter the passphrase repeatedly.
88+
89+
```shell
90+
# Start agent (usually auto-started on macOS)
91+
eval "$(ssh-agent -s)"
92+
93+
# Add key
94+
ssh-add ~/.ssh/id_ed25519
95+
96+
# macOS - Use keychain for persistence across reboots
97+
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
98+
99+
# macOS - Add to `~/.ssh/config` so keys auto-load:
100+
# Host *
101+
# AddKeysToAgent yes
102+
# UseKeychain yes
103+
# IdentityFile ~/.ssh/id_ed25519
104+
```
105+
106+
> [↑ Back to Table of Contents](#table-of-contents)
107+
108+
---
109+
110+
## Use Case: Git Hosting
111+
112+
### Copy Public Key
113+
114+
```shell
115+
# Display public key (copy the output)
116+
cat ~/.ssh/id_ed25519.pub
117+
118+
# macOS: copy directly to clipboard
119+
pbcopy < ~/.ssh/id_ed25519.pub
120+
```
121+
122+
### Add Key to GitHub
123+
124+
**GitHub**:
125+
126+
1. Go to [**GitHub Settings**](https://github.com/settings/) > [**SSH and GPG keys**](https://github.com/settings/keys)
127+
2. Click **New SSH key**
128+
3. Title: descriptive name (e.g., "[Color] MacBook Pro [YYYY]")
129+
4. Key type: **Authentication Key**
130+
5. Paste your public key
131+
6. Click **Add SSH key**
132+
133+
### URL Rewriting
134+
135+
> [!TIP]
136+
>
137+
> **Use HTTPS URLs but authenticate via SSH** - clone commands from GitHub's UI work as-is, no manual URL conversion needed.
138+
139+
```shell
140+
git config --global url."git@github.com:".insteadOf "https://github.com/"
141+
```
142+
143+
With this config:
144+
145+
```shell
146+
# This HTTPS URL from GitHub's UI...
147+
git clone https://github.com/username/repo.git
148+
149+
# ...automatically uses SSH authentication
150+
# (Git rewrites it to git@github.com:username/repo.git)
151+
```
152+
153+
### Test Connection
154+
155+
```shell
156+
ssh -T git@github.com
157+
```
158+
159+
Expected output:
160+
161+
```shell
162+
Hi USERNAME! You've successfully authenticated, but GitHub does not provide shell access.
163+
```
164+
165+
> [↑ Back to Table of Contents](#table-of-contents)
166+
167+
---
168+
169+
## Use Case: Remote Servers
170+
171+
The same SSH key can authenticate to Linux servers, cloud VMs, and any SSH-enabled host.
172+
173+
### Add Key to Host
174+
175+
**Automatic** (recommended):
176+
177+
```shell
178+
ssh-copy-id user@remote-host
179+
```
180+
181+
This copies your public key to the remote host's `~/.ssh/authorized_keys`.
182+
183+
**Manual** (if `ssh-copy-id` unavailable):
184+
185+
```shell
186+
cat ~/.ssh/id_ed25519.pub | ssh user@remote-host "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
187+
```
188+
189+
### Connect
190+
191+
```shell
192+
ssh user@remote-host
193+
```
194+
195+
With a custom port:
196+
197+
```shell
198+
ssh -p 2222 user@remote-host
199+
```
200+
201+
### File Transfer (SCP)
202+
203+
**Upload** file to remote:
204+
205+
```shell
206+
scp local-file.txt user@remote-host:~/
207+
```
208+
209+
**Download** file from remote:
210+
211+
```shell
212+
scp user@remote-host:~/remote-file.txt ./
213+
```
214+
215+
**Upload directory** (recursive):
216+
217+
```shell
218+
scp -r local-dir/ user@remote-host:~/
219+
```
220+
221+
> [↑ Back to Table of Contents](#table-of-contents)
222+
223+
---
224+
225+
## Troubleshooting
226+
227+
### Permission Denied
228+
229+
**Symptom**:
230+
231+
```shell
232+
Permission denied (publickey).
233+
```
234+
235+
**Causes and fixes**:
236+
237+
1. **Key not added to target**:
238+
- For Git: Check key is in GitHub/GitLab SSH settings
239+
- For servers: Check `~/.ssh/authorized_keys` on remote host
240+
241+
2. **Key not in ssh-agent**:
242+
243+
```shell
244+
ssh-add -l # List loaded keys
245+
ssh-add ~/.ssh/id_ed25519 # Add if missing
246+
```
247+
248+
3. **Wrong key being used**: Create `~/.ssh/config` to specify key per host:
249+
250+
```text
251+
Host github.com
252+
IdentityFile ~/.ssh/id_ed25519
253+
254+
Host work-server
255+
HostName 192.168.1.100
256+
User admin
257+
IdentityFile ~/.ssh/id_work
258+
```
259+
260+
### Agent Issues
261+
262+
**Symptom**: Key not persisting across terminal sessions.
263+
264+
**Fix**:
265+
266+
```shell
267+
# Restart agent and re-add key
268+
eval "$(ssh-agent -s)"
269+
ssh-add ~/.ssh/id_ed25519
270+
271+
# macOS: use keychain for persistence
272+
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
273+
```
274+
275+
**Auto-start on shell login**: Add to `~/.bashrc` or `~/.zshrc`:
276+
277+
```shell
278+
if [ -z "$SSH_AUTH_SOCK" ]; then
279+
eval "$(ssh-agent -s)"
280+
ssh-add ~/.ssh/id_ed25519
281+
fi
282+
```
283+
284+
> [↑ Back to Table of Contents](#table-of-contents)
285+
286+
---
287+
288+
> Use Cases - SSH Authentication v1.0.0 - KemingHe/common-devx

0 commit comments

Comments
 (0)