Linux · Systems fluency
How do SSH keys work and how should they be managed?
Short answer
SSH key authentication uses a private key that never leaves the client and a public key placed in the server authorized_keys file. The server issues a challenge that only the private key can answer.
Ed25519 is a good default for new keys because it is small, fast, and avoids the parameter choices of RSA. Protect private keys with a passphrase and load them into an agent for convenience. The private key must remain readable only by its owner.
ssh-keygen -t ed25519 -a 100 -C "deploy@example.com"
ssh-copy-id deploy@example.com
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keysServer-side rules
- authorized_keys entries can restrict source addresses and forced commands
- The .ssh directory should be 700 and authorized_keys 600
- Home directories must not be writable by group or other
- PermitRootLogin no and PasswordAuthentication no reduce exposure
- Rotate keys and remove access for departed staff promptly
Certificates signed by a trusted CA scale better than copying keys to every host. They allow short-lived credentials, central revocation, and principal-based access. Hardware-backed keys keep the private key off the workstation disk.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Why is Ed25519 a good default key type?
- 2What permissions does SSH require for .ssh and authorized_keys?
- 3What problem do SSH certificates solve?
- 4How do you revoke a compromised key?
Say it in the interview
SSH key auth uses a public key on the server and a private key on the client. The private key should have a passphrase and never leave the client. I set strict permissions on .ssh and authorized_keys and disable password and root login. At scale I prefer short-lived certificates because revocation is centralized.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Linux mock interview and get scored feedback on depth, clarity and confidence.