SSH Authentication

SSH authentication verifies your identity to the remote server. The protocol supports multiple methods, tried in a configurable order. Public-key authentication (using Ed25519 or RSA keys) is the standard; passwords are now considered legacy.

Authentication methods, in typical order:

• Public-key — uses private/public key pair (most common, most secure)
• Password — type password (now deprecated for remote servers)
• Keyboard-interactive — challenge/response (sometimes used for MFA)
• GSSAPI — Kerberos-based (enterprise environments)

Server-side configuration in sshd_config:

PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes

Client-side configuration in ~/.ssh/config:

Host secure
    PubkeyAuthentication yes
    PasswordAuthentication no

Force public-key only: ssh -o PubkeyOnly=yes user@host

Try specific key: ssh -i ~/.ssh/id_ed25519 user@host

SSH attempts keys in this order: 1. Keys specified by -i flag 2. Keys in IdentityFile entries from config 3. Default locations: ~/.ssh/id_ed25519, ~/.ssh/id_rsa, etc.

Public-key authentication is immune to password brute-force attacks and doesn't require typing a password every time (especially if using an SSH agent).

View which authentication succeeded: ssh -vv user@host and look for “Authentications that can continue” and “Offering public key”.