SSH and remote identity
Navigate a project and describe how its interpreter, dependencies and configuration are selected.
THE IDEA
A key pair proves who you are without sending a secret
SSH uses a key pair: a private key that stays on your machine and a public key you can hand to anyone. The server never sees your private key. It only needs to check that you hold it.
1. Generate
ssh-keygen creates two files: id_ed25519 (private) and id_ed25519.pub (public). Keep the first secret; the second is safe to share.
Which file is which
~/.ssh/id_ed25519Private key. Permissions must be 600, or ssh refuses to use it. Never share it.
~/.ssh/id_ed25519.pubPublic key. Safe to share and to paste into a server or a service.
authorized_keys (on the server)The public keys the server accepts for that account, one per line.
~/.ssh/known_hosts (on your laptop)The servers you have connected to, with their host keys.
Predict first. Which half of an SSH key pair can you safely share?
The other direction: is this the right server?
Keys identify you to the server. The server identifies itself with its own host key. The first time you connect, ssh shows the host key's fingerprint and asks you to confirm it. Compare it with a fingerprint you obtained another way, such as from your provider's console, because an encrypted connection to the wrong machine is still the wrong machine. ssh remembers accepted keys in known_hosts and warns loudly if the key later changes.
Chapter context
A terminal runs commands in a current working directory. An environment makes the program's interpreter, dependencies and configuration explicit so a successful run can be repeated elsewhere.
TRY IT YOURSELF
You have a laptop and a server named server.example.com. Watch the diagram: it updates as you create keys, install them and connect.
- Generate an ed25519 key pair (the real command also asks for a file and a passphrase; here it uses the defaults)
- Inspect ~/.ssh and spot which file is private by its permissions
- Try to log in before the server knows your key and read the refusal
- Install your public key on the server
- Make the private key readable by others (chmod 644) and see ssh refuse to use it
- Fix the permissions (chmod 600) and log in
- On the server, read app/status.txt
- Log out and confirm you are back on your laptop
✗ key pair exists
✗ private key permissions safe (600)
✗ your public key is in authorized_keys
○ not connected
Stuck, or something not working? You can come back to it any time.
CHECK YOUR UNDERSTANDING
Which half of an SSH key pair can be shared?
Chapter reference: math, worked example & code
This section belongs to the whole chapter, so it is the same on every lesson in it and may cover a different lesson's topic. The code for the experiment you just ran is inside the experiment itself.
Math and notation
A reproducible run can be described as (source revision, interpreter, dependency resolution, input data, configuration). Equal source code alone is insufficient. For pipelines, compare the records emitted at each stage rather than assuming every command preserves row counts.
Worked example
A project processes 12 lines, filters to 5 matching lines, then counts them. The final count is 5, not 12. In a path puzzle, joining /work/project with data and train.csv identifies the input without changing the real filesystem.
Reference code
The following example uses the Python standard library and does not call a remote service.
from pathlib import PurePosixPath
path = PurePosixPath('/work/project') / 'data' / 'train.csv'
assert str(path) == '/work/project/data/train.csv'
lines = ['keep' if i < 5 else 'drop' for i in range(12)]
assert sum(line == 'keep' for line in lines) == 5
Python examples are provided for study and local execution; this page does not execute Python.
Common mistakes
A virtual environment is not a security sandbox. A lockfile does not preserve external input datasets. Ignoring a secret after committing it does not undo exposure.