The key at the door (SSH: keys, known hosts, the agent and tunnels)

A slice of a giant machine rented in the cloud, and the encrypted line you use to reach it: ssh root@203.0.113.10, a key pair, authorized_keys. This lesson walks through that door twice: once as the person knocking, once as the door deciding whether to open.

Before you start. From The whisper code (how a call goes private) you have the split lock: a key in two halves, a public half anyone may see and a private half its owner never shows, where only the matching private half can open what the public half locked, or sign what the public half can check. You also have the forged ID card of 2011: a perfect lock is worthless if you are talking to the wrong door. From TCP vs UDP, and the 3-way handshake you have ports, the numbered doors on one address. SSH is the split lock used for a different job: not reading a website, but typing commands on a computer somewhere else.

The idea in 30 seconds

SSH replaced plain-text remote logins in 1995; its default port is 22 because Tatu Ylönen asked for it.
The server proves itself with its host key, and your laptop records that key in known_hosts the first time (trust on first use); a changed key is either a rebuilt server or someone in the middle.
You prove yourself by signing a fresh challenge with your private key; the server checks it against the public keys in authorized_keys, so nothing secret is sent or stored.
ssh-agent holds your unlocked private key and signs for you; forwarding it with -A lets the remote server use it while you are connected, which is why -J is the safer way to hop.
-L and -R turn the connection into an encrypted tunnel to a port on the other side.

Read the story · Skip to the numbers