World map

 

BM

World L4: Remote Kitchens

SSH keys

You will learn: to make a key pair and hang your padlock on a server's door.

Checked with Linux (Debian 13) on 1 Nov 2026

The problem

laptop
ssh you@10.0.0.5
you@10.0.0.5's password:

SSH: A sealed phone line to a far-away kitchen. You type there as if you stood inside. is a sealed phone line to a far-away kitchen. But every call asks for a password. Robots guess passwords all day. There is a better lock.

Try it

A key pair is a padlock and its only key. The padlock (.pub) is safe to give away. The key stays with you. Sort them.

Drag a card into a box. Or tap the card, then tap the box.

      Try it

      Make your pair. On a real machine, press Enter at each question (or pick a passphrase). Here, they answer themselves.

      You are hereyou@kedai:~$

      Folder ~

      Empty folder

      + 3 hidden (ls -a)

      Services

      • cronrunningstarts at boot
      • sshrunningstarts at boot
      • nginxrunningstarts at boot

      Watch

      ls -l ~/.ssh after making the pair. Tap the line only you may read.

      Tap the private key.

      0 of 1 found

      Watch

      laptop (lab)
      ssh-copy-id you@10.0.0.5
      /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/you/.ssh/id_ed25519.pub"
      /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
      /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
      you@10.0.0.5's password:
      Number of key(s) added: 1
      Now try logging into the machine, with: "ssh 'you@10.0.0.5'"
      and check to make sure that only the key(s) you wanted were added.
      ssh you@10.0.0.5 hostname
      kedai

      ssh-copy-id hangs your padlock on the server’s door, after one last password. No password after that.

      Try it

      Now be the server. Hang Aina’s padlock: add aina.pub to ~/.ssh/authorized_keys, then chmod 600 it.

      You are hereyou@kedai:~$

      Folder ~

      • aina.pub-rw-r--r--

      + 4 hidden (ls -a)

      Services

      • cronrunningstarts at boot
      • sshrunningstarts at boot
      • nginxrunningstarts at boot

      Predict

      Your first call to a new server shows this. What is ssh checking?

      The authenticity of host '10.0.0.5 (10.0.0.5)' can't be established.
ED25519 key fingerprint is SHA256:aYFyPi8Iw5RKqAeYPFwKCGKES8fXkU1HvaXk3yHsckY.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

      You did it!

      You can now make a key pair and hang your padlock on a server.

      Go deeper (optional)

      A passphrase locks your key file too; ssh-agent remembers it for a session. The server’s ID card is its host key: The server's own ID card. Your laptop remembers it in ~/.ssh/known_hosts.. Practice keys here are made up. The lab outputs came from two real Debian 13 machines.

      Real mission

      1. ssh-keygen -t ed25519 -C "you@laptop"
      2. ssh-copy-id you@YOUR-VM-IP
      3. ssh you@YOUR-VM-IP

      0 of 3 steps done · Your ticks are saved.