|
| 1 | +# Use Cases - SSH Authentication |
| 2 | + |
| 3 | +> **Last Updated**: 2026-02-06 by Keming He |
| 4 | +
|
| 5 | +## Platform |
| 6 | + |
| 7 | +> [!IMPORTANT] |
| 8 | +> |
| 9 | +> This guide is for **macOS / Linux** users with POSIX-compatible shell (sh, bash, zsh). |
| 10 | +> |
| 11 | +> For **Windows** users: See [GitHub: Connecting to GitHub with SSH](https://docs.github.com/en/authentication/connecting-to-github-with-ssh). |
| 12 | +
|
| 13 | +Authenticate to Git hosting services and remote servers using SSH keys. |
| 14 | + |
| 15 | +## Table of Contents |
| 16 | + |
| 17 | +- [Use Cases - SSH Authentication](#use-cases---ssh-authentication) |
| 18 | + - [Platform](#platform) |
| 19 | + - [Table of Contents](#table-of-contents) |
| 20 | + - [Why Use SSH Keys?](#why-use-ssh-keys) |
| 21 | + - [Check for Existing Keys](#check-for-existing-keys) |
| 22 | + - [Generate New Key](#generate-new-key) |
| 23 | + - [Generate Key](#generate-key) |
| 24 | + - [Add to ssh-agent](#add-to-ssh-agent) |
| 25 | + - [Use Case: Git Hosting](#use-case-git-hosting) |
| 26 | + - [Copy Public Key](#copy-public-key) |
| 27 | + - [Add Key to GitHub](#add-key-to-github) |
| 28 | + - [URL Rewriting](#url-rewriting) |
| 29 | + - [Test Connection](#test-connection) |
| 30 | + - [Use Case: Remote Servers](#use-case-remote-servers) |
| 31 | + - [Add Key to Host](#add-key-to-host) |
| 32 | + - [Connect](#connect) |
| 33 | + - [File Transfer (SCP)](#file-transfer-scp) |
| 34 | + - [Troubleshooting](#troubleshooting) |
| 35 | + - [Permission Denied](#permission-denied) |
| 36 | + - [Agent Issues](#agent-issues) |
| 37 | + |
| 38 | +## Why Use SSH Keys? |
| 39 | + |
| 40 | +- **Passwordless auth**: No prompts for git operations or server logins |
| 41 | +- **More secure**: Key-based authentication is stronger than passwords |
| 42 | +- **One setup, multiple uses**: Same key works for Git hosting, servers, and file transfer |
| 43 | + |
| 44 | +> [↑ Back to Table of Contents](#table-of-contents) |
| 45 | +
|
| 46 | +--- |
| 47 | + |
| 48 | +## Check for Existing Keys |
| 49 | + |
| 50 | +```shell |
| 51 | +ls -la ~/.ssh |
| 52 | +``` |
| 53 | + |
| 54 | +Look for files like `id_ed25519` and `id_ed25519.pub` (or `id_rsa`/`id_rsa.pub`). If you have a key pair, you can skip to [Add to ssh-agent](#add-to-ssh-agent). |
| 55 | + |
| 56 | +> [↑ Back to Table of Contents](#table-of-contents) |
| 57 | +
|
| 58 | +--- |
| 59 | + |
| 60 | +## Generate New Key |
| 61 | + |
| 62 | +### Generate Key |
| 63 | + |
| 64 | +**Ed25519** (recommended - smaller, faster, more secure): |
| 65 | + |
| 66 | +```shell |
| 67 | +ssh-keygen -t ed25519 -C "your-email@example.com" |
| 68 | +``` |
| 69 | + |
| 70 | +When prompted: |
| 71 | + |
| 72 | +1. Press **Enter** to accept the default file location (`~/.ssh/id_ed25519`) |
| 73 | +2. Enter a passphrase (optional but recommended) |
| 74 | + |
| 75 | +> [!TIP] |
| 76 | +> |
| 77 | +> **Passphrase adds security** - if your private key is compromised, the attacker still needs the passphrase. The ssh-agent caches it so you don't type it repeatedly. |
| 78 | +
|
| 79 | +For legacy systems that don't support Ed25519: |
| 80 | + |
| 81 | +```shell |
| 82 | +ssh-keygen -t rsa -b 4096 -C "your-email@example.com" |
| 83 | +``` |
| 84 | + |
| 85 | +### Add to ssh-agent |
| 86 | + |
| 87 | +The ssh-agent caches your key so you don't enter the passphrase repeatedly. |
| 88 | + |
| 89 | +```shell |
| 90 | +# Start agent (usually auto-started on macOS) |
| 91 | +eval "$(ssh-agent -s)" |
| 92 | + |
| 93 | +# Add key |
| 94 | +ssh-add ~/.ssh/id_ed25519 |
| 95 | + |
| 96 | +# macOS - Use keychain for persistence across reboots |
| 97 | +ssh-add --apple-use-keychain ~/.ssh/id_ed25519 |
| 98 | + |
| 99 | +# macOS - Add to `~/.ssh/config` so keys auto-load: |
| 100 | +# Host * |
| 101 | +# AddKeysToAgent yes |
| 102 | +# UseKeychain yes |
| 103 | +# IdentityFile ~/.ssh/id_ed25519 |
| 104 | +``` |
| 105 | + |
| 106 | +> [↑ Back to Table of Contents](#table-of-contents) |
| 107 | +
|
| 108 | +--- |
| 109 | + |
| 110 | +## Use Case: Git Hosting |
| 111 | + |
| 112 | +### Copy Public Key |
| 113 | + |
| 114 | +```shell |
| 115 | +# Display public key (copy the output) |
| 116 | +cat ~/.ssh/id_ed25519.pub |
| 117 | + |
| 118 | +# macOS: copy directly to clipboard |
| 119 | +pbcopy < ~/.ssh/id_ed25519.pub |
| 120 | +``` |
| 121 | + |
| 122 | +### Add Key to GitHub |
| 123 | + |
| 124 | +**GitHub**: |
| 125 | + |
| 126 | +1. Go to [**GitHub Settings**](https://github.com/settings/) > [**SSH and GPG keys**](https://github.com/settings/keys) |
| 127 | +2. Click **New SSH key** |
| 128 | +3. Title: descriptive name (e.g., "[Color] MacBook Pro [YYYY]") |
| 129 | +4. Key type: **Authentication Key** |
| 130 | +5. Paste your public key |
| 131 | +6. Click **Add SSH key** |
| 132 | + |
| 133 | +### URL Rewriting |
| 134 | + |
| 135 | +> [!TIP] |
| 136 | +> |
| 137 | +> **Use HTTPS URLs but authenticate via SSH** - clone commands from GitHub's UI work as-is, no manual URL conversion needed. |
| 138 | +
|
| 139 | +```shell |
| 140 | +git config --global url."git@github.com:".insteadOf "https://github.com/" |
| 141 | +``` |
| 142 | + |
| 143 | +With this config: |
| 144 | + |
| 145 | +```shell |
| 146 | +# This HTTPS URL from GitHub's UI... |
| 147 | +git clone https://github.com/username/repo.git |
| 148 | + |
| 149 | +# ...automatically uses SSH authentication |
| 150 | +# (Git rewrites it to git@github.com:username/repo.git) |
| 151 | +``` |
| 152 | + |
| 153 | +### Test Connection |
| 154 | + |
| 155 | +```shell |
| 156 | +ssh -T git@github.com |
| 157 | +``` |
| 158 | + |
| 159 | +Expected output: |
| 160 | + |
| 161 | +```shell |
| 162 | +Hi USERNAME! You've successfully authenticated, but GitHub does not provide shell access. |
| 163 | +``` |
| 164 | +
|
| 165 | +> [↑ Back to Table of Contents](#table-of-contents) |
| 166 | +
|
| 167 | +--- |
| 168 | +
|
| 169 | +## Use Case: Remote Servers |
| 170 | +
|
| 171 | +The same SSH key can authenticate to Linux servers, cloud VMs, and any SSH-enabled host. |
| 172 | +
|
| 173 | +### Add Key to Host |
| 174 | +
|
| 175 | +**Automatic** (recommended): |
| 176 | +
|
| 177 | +```shell |
| 178 | +ssh-copy-id user@remote-host |
| 179 | +``` |
| 180 | +
|
| 181 | +This copies your public key to the remote host's `~/.ssh/authorized_keys`. |
| 182 | + |
| 183 | +**Manual** (if `ssh-copy-id` unavailable): |
| 184 | + |
| 185 | +```shell |
| 186 | +cat ~/.ssh/id_ed25519.pub | ssh user@remote-host "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys" |
| 187 | +``` |
| 188 | + |
| 189 | +### Connect |
| 190 | + |
| 191 | +```shell |
| 192 | +ssh user@remote-host |
| 193 | +``` |
| 194 | + |
| 195 | +With a custom port: |
| 196 | + |
| 197 | +```shell |
| 198 | +ssh -p 2222 user@remote-host |
| 199 | +``` |
| 200 | + |
| 201 | +### File Transfer (SCP) |
| 202 | + |
| 203 | +**Upload** file to remote: |
| 204 | + |
| 205 | +```shell |
| 206 | +scp local-file.txt user@remote-host:~/ |
| 207 | +``` |
| 208 | + |
| 209 | +**Download** file from remote: |
| 210 | + |
| 211 | +```shell |
| 212 | +scp user@remote-host:~/remote-file.txt ./ |
| 213 | +``` |
| 214 | + |
| 215 | +**Upload directory** (recursive): |
| 216 | + |
| 217 | +```shell |
| 218 | +scp -r local-dir/ user@remote-host:~/ |
| 219 | +``` |
| 220 | + |
| 221 | +> [↑ Back to Table of Contents](#table-of-contents) |
| 222 | + |
| 223 | +--- |
| 224 | + |
| 225 | +## Troubleshooting |
| 226 | + |
| 227 | +### Permission Denied |
| 228 | + |
| 229 | +**Symptom**: |
| 230 | + |
| 231 | +```shell |
| 232 | +Permission denied (publickey). |
| 233 | +``` |
| 234 | + |
| 235 | +**Causes and fixes**: |
| 236 | + |
| 237 | +1. **Key not added to target**: |
| 238 | + - For Git: Check key is in GitHub/GitLab SSH settings |
| 239 | + - For servers: Check `~/.ssh/authorized_keys` on remote host |
| 240 | + |
| 241 | +2. **Key not in ssh-agent**: |
| 242 | + |
| 243 | + ```shell |
| 244 | + ssh-add -l # List loaded keys |
| 245 | + ssh-add ~/.ssh/id_ed25519 # Add if missing |
| 246 | + ``` |
| 247 | + |
| 248 | +3. **Wrong key being used**: Create `~/.ssh/config` to specify key per host: |
| 249 | + |
| 250 | + ```text |
| 251 | + Host github.com |
| 252 | + IdentityFile ~/.ssh/id_ed25519 |
| 253 | + |
| 254 | + Host work-server |
| 255 | + HostName 192.168.1.100 |
| 256 | + User admin |
| 257 | + IdentityFile ~/.ssh/id_work |
| 258 | + ``` |
| 259 | + |
| 260 | +### Agent Issues |
| 261 | + |
| 262 | +**Symptom**: Key not persisting across terminal sessions. |
| 263 | + |
| 264 | +**Fix**: |
| 265 | + |
| 266 | +```shell |
| 267 | +# Restart agent and re-add key |
| 268 | +eval "$(ssh-agent -s)" |
| 269 | +ssh-add ~/.ssh/id_ed25519 |
| 270 | +
|
| 271 | +# macOS: use keychain for persistence |
| 272 | +ssh-add --apple-use-keychain ~/.ssh/id_ed25519 |
| 273 | +``` |
| 274 | + |
| 275 | +**Auto-start on shell login**: Add to `~/.bashrc` or `~/.zshrc`: |
| 276 | + |
| 277 | +```shell |
| 278 | +if [ -z "$SSH_AUTH_SOCK" ]; then |
| 279 | + eval "$(ssh-agent -s)" |
| 280 | + ssh-add ~/.ssh/id_ed25519 |
| 281 | +fi |
| 282 | +``` |
| 283 | + |
| 284 | +> [↑ Back to Table of Contents](#table-of-contents) |
| 285 | + |
| 286 | +--- |
| 287 | + |
| 288 | +> Use Cases - SSH Authentication v1.0.0 - KemingHe/common-devx |
0 commit comments