Ivan's wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
# SSH authentication

**SSH authentication** verifies your identity to the remote server. The protocol supports multiple methods, tried in a configurable order. Public-key authentication (using Ed25519 or RSA keys) is the standard; passwords are now considered legacy.

Authentication methods, in typical order:

- **Public-key**: uses private/public key pair (most common, most secure)
- **Password**: type password (now deprecated for remote servers)
- **Keyboard-interactive**: challenge/response (sometimes used for MFA)
- **GSSAPI**: Kerberos-based (enterprise environments)

Server-side configuration in `sshd_config`:

```
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
```

Client-side configuration in `~/.ssh/config`:

```
Host secure
    PubkeyAuthentication yes
    PasswordAuthentication no
```

Force public-key only: `ssh -o PubkeyOnly=yes user@host`

Try specific key: `ssh -i ~/.ssh/id_ed25519 user@host`

SSH attempts keys in this order:
1. Keys specified by `-i` flag
2. Keys in `IdentityFile` entries from config
3. Default locations: `~/.ssh/id_ed25519`, `~/.ssh/id_rsa`, etc.

Public-key authentication is immune to password brute-force attacks and doesn't require typing a password every time (especially if using an SSH agent).

View which authentication succeeded: `ssh -vv user@host` and look for "Authentications that can continue" and "Offering public key".