====== PUBLIC KEY AUTHENTICATION FOR SSH ======

==== OVERVIEW ====

SSH keeys come in pairs:
  * //.ssh/id_rsa// - private key
  * //.ssh/id_rsa.pub// - public key

Public key should be copied to servers into //~/.ssh/authorized_keys// (it let's the server authenticate the user).

During the client authentication, the client will use its private key, and it will be verified by the public key stored in //~/.ssh/authorized_keys//.

Private key is password protected when encrypted. A passphrase is only used to unlock the private key locally and is not transmitted in any form to the remote host.

==== GENERATING KEYS ====

This will generate private/public keys in the default directory:
<code bash>
$ ssh-keygen -b 4096 # default size is 2048
</code>

Files are here:
<code bash>
clienthost:~ user$ ls -l .ssh/ | grep id
-rw-------  1 user  user   1831 Aug 10 20:50 id_rsa
-rw-r--r--  1 user  user    407 Aug 10 20:50 id_rsa.pub
</code>

After public key is copied to remote serve:
<code bash>
$ chmod 700 .ssh/
$ chmod 600 ~/.ssh/authorized_keys # paste your public key into this file
</code>

There is also a simpler way to copy a public key:
<code bash>
$ ssh-copy-id pi@192.168.2.73
</code>
==== SSHD ====

/etc/ssh/sshd_config:
<code bash>
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys
</code>

==== MANAGING PASSPHRASE ====

<code bash>
$ ssh-agent
$ ssh-add
</code>