Secure access
Use SSH keys safely
Generate a modern key locally, protect the private key, install only the public key, and remove stale authorized keys.
8 minute lesson
Your SSH private key stays on your machine. The server receives the public key.
Use a supported modern key type, a passphrase where practical, and an agent or secure hardware for frequent use. Verify host fingerprints on first connection. Label authorized keys and remove them when a device or person no longer needs access.
A key copied across ten servers turns one stolen laptop into ten entry points. A dedicated key costs more management but allows narrow revocation and clearer attribution.
Host verification protects the other direction. Record the expected server fingerprint through a trusted channel so a convincing login prompt cannot silently collect credentials or commands.
Create a dedicated lab key and record its fingerprint beside the authorized entry. Remove that public key, then prove the old private key fails while the documented recovery key still works.
Lesson completed