Differences

This shows you the differences between two versions of the page.

--- linux:ssh [2026/05/18 14:44] – created v1ctor
+++ linux:ssh [2026/05/18 15:07] (current) – [PUBLIC KEY AUTHENTICATION] v1ctor
@@ Line 2: / Line 2: @@
 ===== PUBLIC KEY AUTHENTICATION =====
+=== SSH AGENT ====
+''ssh-agent'' is a background process that holds your decrypted private keys in memory so you don't have to type the passphrase every time you SSH somewhere. Private SSH keys should be encrypted on disk with a passphrase. Without an agent, every ssh, git pull, scp etc. would prompt you to type that passphrase to decrypt the key.
+How it works:
+  - Agent starts as a background process, listening on a unix socket. Its path is exported as $SSH_AUTH_SOCK.
+  - You run ssh-add <key> once — passphrase prompt, decrypted key goes into agent memory.
+  - When ssh connects somewhere, it checks $SSH_AUTH_SOCK, asks the agent for available keys, and asks the agent to sign the server's challenge.
+With agent **forwarding** (ssh -A bastion, or ForwardAgent yes in config), SSH forwards $SSH_AUTH_SOCK from your laptop into the bastion shell. When you then run ssh internal-server from the bastion.
+=== SSH KEYS ====
 SSH keeys come in pairs:
@@ Line 13: / Line 26: @@
 Private key is password protected when encrypted. A passphrase is only used to unlock the private key locally and is not transmitted in any form to the remote host.
-==== GENERATING KEYS ====
+=== GENERATING KEYS ===
 This will generate private/public keys in the default directory:
@@ Line 37: / Line 50: @@
 $ ssh-copy-id pi@192.168.2.73
 </code>
-==== SSHD ====
+=== SSHD ===
 /etc/ssh/sshd_config:
@@ Line 45: / Line 58: @@
 </code>
-==== MANAGING PASSPHRASE ====
+=== MANAGING PASSPHRASE ===
 <code bash>