# SSH

## Key Based Authentication

```powershell
ssh-keygen -t rsa -b 4096 # Create private key on your pc, -t for type, -b for byte lenght
ssh-copy-id {user}@{server} # Copy that key to server
```

Consist of the **Private** and **Public** keys, and allows login to the servers without password. It's more secure than password login, because you basically using massive random string as your password. Public key should be known to the server and Private key should be keep secret. They mathematically linked together, using the Public key you can encrypt messages, and only Private key can decrypt it now. So when you ask the server for login, it will encrypt message using your Public key and send it to you, if you can decrypt it, then you the one that has Private key and it will log you in. Because of that you need to keep your Public key a secret.

When you create ssh keys, you can provide passphrase to encrypt this key on your machine. And every time you want to use it, you need to type this passphrase. To avoid that you can use **ssh-agent**. After that you need to copy your Public key to the server to the `~/.shh/authorized_keys` file. You can use **ssh-copy-id** or, if you can't use this command, manually copy Public key to that file, if file or directory doesn't exist, create them, and change permissions to 700 for directory and 600 for all files in it.

Optionally, after that, you can disable password login in `sshd_config`. But I don't see the point it that, because ssh key can be expandable, you can rotate them, or you can lose your private key because of the HDD malfunction. And now you can't log in to the server, because you disabled password login. For me better to change the password to the strong one, use password manager to store it. If you want more security, set up fail to ban system.

## Config

You can create `~/.shh/config` file to use your own names for servers, so instead of typing `ssh username@10.10.10.10` you can type `ssh servername`.

Example of the config file:

```powershell
Host servername
        User username
        HostName 10.10.10.10
```