# SSH Authentication

**SSH authentication** verifies your identity to the remote server. The protocol supports multiple methods, tried in a configurable order. Public-key authentication (using Ed25519 or RSA keys) is the standard; passwords are now considered legacy.

Authentication methods, in typical order:

- **Public-key** — uses private/public key pair (most common, most secure)
- **Password** — type password (now deprecated for remote servers)
- **Keyboard-interactive** — challenge/response (sometimes used for MFA)
- **GSSAPI** — Kerberos-based (enterprise environments)

Server-side configuration in `sshd_config`:

```
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
```

Client-side configuration in `~/.ssh/config`:

```
Host secure
    PubkeyAuthentication yes
    PasswordAuthentication no
```

Force public-key only: `ssh -o PubkeyOnly=yes user@host`

Try specific key: `ssh -i ~/.ssh/id_ed25519 user@host`

SSH attempts keys in this order:
1. Keys specified by `-i` flag
2. Keys in `IdentityFile` entries from config
3. Default locations: `~/.ssh/id_ed25519`, `~/.ssh/id_rsa`, etc.

Public-key authentication is immune to password brute-force attacks and doesn't require typing a password every time (especially if using an SSH agent).

View which authentication succeeded: `ssh -vv user@host` and look for "Authentications that can continue" and "Offering public key".