Key-Based Auth & Configuration

Generating & Deploying Keys

ssh-keygen -t ed25519 -C "you@example.com"    # modern, fast, secure default
# adding a passphrase means a stolen key FILE alone isn't immediately usable

ssh-copy-id user@server                        # appends your public key to
                                                # ~/.ssh/authorized_keys remotely

# ssh-agent — holds decrypted keys in memory so you don't re-enter the
# passphrase on every connection
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

ssh -p 2222 user@hostname                      # non-default port

~/.ssh/config

Host myserver
  HostName 203.0.113.5
  User deploy
  Port 2222
  IdentityFile ~/.ssh/id_ed25519

Host bastion
  HostName bastion.example.com
  User ops

Host private-db
  HostName 10.0.1.20
  User admin
  ProxyJump bastion          # tunnel through the bastion automatically

# Now:  ssh myserver   instead of the full connection command every time
# ssh -J bastion private-db  does the same jump manually, one-off

known_hosts & Server Hardening

known_hosts stores public host keys of servers you've connected to before — if a server's key unexpectedly changes, your client warns loudly (a possible man-in-the-middle sign, though often just a rebuilt server). Disabling StrictHostKeyChecking globally removes this check; only disable it deliberately for genuinely ephemeral hosts like throwaway CI runners.

# /etc/ssh/sshd_config — server-side hardening
PasswordAuthentication no   # key-only login — closes off brute-force attacks
PermitRootLogin no
Port 2222                   # optional — reduces automated scan noise, not real security