SSH Passwordless Authentication on Linux: A Complete Guide

Table of Contents

🔐 Why Use SSH Passwordless Authentication?
#

SSH (Secure Shell) is the foundation of modern remote system administration. While password-based authentication is easy to start with, it introduces serious risks:

Vulnerable to brute-force attacks
Inconvenient for automation and scripting
Difficult to manage securely at scale

Key-based (passwordless) authentication solves these problems by using asymmetric cryptography, providing stronger security and seamless automation.

🔑 How SSH Key Authentication Works
#

SSH key authentication relies on a cryptographic challenge–response mechanism rather than transmitting secrets over the network.

Private Key: Stored only on the client machine.
⚠️ Never share or copy this file.
Public Key: Stored on the server in a trusted list.
Authentication Flow:
The server encrypts a challenge using the public key.
Only the matching private key can decrypt it, proving identity without revealing the key itself.

No passwords are exchanged at any stage.

🏗️ Step 1: Generate an SSH Key Pair
#

On your local Linux machine, generate a strong RSA key pair:

ssh-keygen -t rsa -b 4096 -C "admin@vxworks.net"

Key Generation Notes
#

Storage Location: Press Enter to accept the default (~/.ssh/id_rsa)
Passphrase (Optional):
- Leave empty for fully passwordless automation
- Use a passphrase for extra security (recommended with ssh-agent)

Verify Key Files
#

ls ~/.ssh/
# id_rsa      → private key
# id_rsa.pub  → public key

📤 Step 2: Install the Public Key on the Server
#

The remote server must store your public key in its trusted key list.

Method A: Automatic (Recommended)
#

ssh-copy-id user@remote_host

This command:

Creates ~/.ssh if missing
Sets correct permissions
Appends the key safely

Method B: Manual Installation
#

Display your public key:

cat ~/.ssh/id_rsa.pub

On the remote server, run:

mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "ssh-rsa AAAAB3Nza...[your_key]..." >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

🛡️ Mandatory Permission Rules (Critical)
#

SSH will refuse key authentication if permissions are too permissive.

Path	Required Permission	Command
`~/.ssh/`	`700` (`drwx------`)	`chmod 700 ~/.ssh`
`authorized_keys`	`600` (`-rw-------`)	`chmod 600 ~/.ssh/authorized_keys`
`id_rsa` (private key)	`600` (`-rw-------`)	`chmod 600 ~/.ssh/id_rsa`

Incorrect permissions are the #1 cause of passwordless login failure.

⚙️ Simplify Logins with SSH Config
#

To avoid typing long commands repeatedly, define connection aliases.

Edit your local SSH config:

nano ~/.ssh/config

Add:

Host my-server
    HostName 192.168.1.100
    User admin
    IdentityFile ~/.ssh/id_rsa

Now connect with:

ssh my-server

🧪 Troubleshooting Common Issues
#

Still prompted for password? Check /etc/ssh/sshd_config on the server:
```
PubkeyAuthentication yes
```
Connection refused? Ensure port 22 (or your custom SSH port) is open in the firewall.
Verbose debugging:
```
ssh -v user@remote_host
```
This shows exactly where authentication fails.