巧匠Developer Cheatsheet
Web Services

SSH Passwordless Login: from ssh-keygen to Permission denied

Passwordless SSH boils down to one sentence: put the public key into the remote authorized_keys. What blocks you is usually the three hidden gates — file permissions, the home directory, and SELinux. This guide covers the full setup and a step-by-step debugging path.

By 巧匠 Team·7 min read·Updated 2026-08-30

The whole idea in one sentence

The client private key and the public key in the remote authorized_keys must match — that is all. Debugging therefore revolves around two things: whether the pair matches, and whether the remote sshd is willing to trust that authorized_keys file (bad permissions make sshd silently refuse to read it).

ssh-keygen -t ed25519 -C "you@laptop"   # 生成密钥对（一路回车即可）
ssh-copy-id user@server                    # 把公钥写入远端 authorized_keys
ssh user@server                            # 验证：不再要密码即成功

The standard three steps and how to verify

① Generate a key: prefer ed25519 (shorter, faster, secure), defaulting to ~/.ssh/id_ed25519; ② Distribute: ssh-copy-id is the most reliable (it appends and fixes permissions); on Windows without it, manually append the key to the remote ~/.ssh/authorized_keys; ③ Verify: `ssh -o BatchMode=yes user@server echo ok` — BatchMode forbids interactive passwords, so a clean ok proves passwordless auth truly works, far more trustworthy than "no password prompt appeared".

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@server "cat >> ~/.ssh/authorized_keys"
# Windows 手动分发公钥的写法

Gate 1: file permissions

sshd is extremely picky: if authorized_keys or .ssh is group-writable it silently ignores the whole file (no error, just a fallback to password auth). Correct values: ~/.ssh 700, authorized_keys 600, private key 600. Same on the Windows side — a too-open private key triggers UNPROTECTED PRIVATE KEY FILE and refuses to use it.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/id_ed25519

Gate 2: the home directory

The sneakier trap: the home directory itself being group/other-writable (common with shared mounts or legacy chmod 777 after manual useradd) — sshd refuses to trust authorized_keys all the same. Check with `ls -ld /home/user` and tighten to 750 or stricter. The checking order is always home → .ssh → file.

ls -ld /home/user        # 家目录不能组/其他人可写
chmod 750 /home/user      # 需要时收紧

Gate 3: SELinux and the server log

On RHEL/CentOS with SELinux enforcing, a wrong security context on authorized_keys also fails silently (especially after manually mv/cp-ing the file). `restorecon -rv ~/.ssh` restores the standard context. For any stuck scenario there is one ultimate weapon: the server log `tail -f /var/log/secure` (Debian/Ubuntu: /var/log/auth.log) combined with a client-side -v reconnect — with both sides visible, the problem has nowhere to hide.

restorecon -rv ~/.ssh                     # SELinux 上下文修复
ssh -v user@server                          # 客户端详细握手过程
tail -f /var/log/secure                    # 服务端拒绝原因

Level up: config aliases and multiple keys

Put frequent connections into ~/.ssh/config: one Host alias replaces a long command line and can bind a different key per server — much cleaner than typing -i every time, and git remotes and deploy scripts benefit equally.

Host prod
  HostName 203.0.113.10
  User deploy
  IdentityFile ~/.ssh/id_ed25519_prod
  ServerAliveInterval 60
# 之后只需：ssh prod

More guides

Git Accident Recovery: Fix Wrong Commits, Wrong Branches and Deleted BranchesThe scariest moment in daily work is "oh no, I messed up a commit or branch". This guide gives copy-ready recovery commands for real accident scenarios, with clear safety boundaries for each.Docker Image Slimming: 5 Steps from 1.2GB to 120MBBigger images mean slower pulls, larger attack surface and higher storage cost. This guide gives 5 immediately applicable slimming steps, each with a reusable Dockerfile snippet and a verification command.Nginx 502 Bad Gateway? Locate It in 5 StepsA 502 means Nginx itself is fine but got an invalid response from the upstream (backend/proxy). This guide gives the shortest path: process → config → timeout → resources → logs.Linux Disk Full: Locate the Real Culprit with df, du and lsofA "No space left on device" error does not mean you should delete files at random. This guide walks through the full path — filesystem water level, directory drill-down, and "deleted but still held" files — plus a safe cleanup order that will not destroy data.Linux CPU at 100%: the Shortest Path from top to the Thread Stack"Restart fixes everything" is the most expensive option when CPU is pegged. This guide gives a reusable path: classify the load, pin the thread, capture what it is executing, then act — with dedicated tools for Java, Python and Go.MySQL Slow Query Tuning: Slow Log, EXPLAIN and Indexing"The database is slow" usually means a handful of slow SQL statements. This guide offers a repeatable flow: use the slow log to circle the most expensive queries, read the plan with EXPLAIN, decide whether an index pays off, and spot the most common index-defeating patterns.Redis Slowdown Playbook: Big Keys, Blocking Commands and EvictionRedis processes commands on a single thread, so one blocking hotspot slows the whole instance. This guide follows the order "memory level → big keys → blocking commands → eviction and persistence", each step with copy-ready commands.Kubernetes CrashLoopBackOff: Diagnose a Restart-Looping Pod in 5 StepsCrashLoopBackOff is not one error but a state: the container dies on start, and Kubernetes retries with backoff. This guide gives the shortest path — exit code → previous logs → probes → resources → dependencies.Python Virtual Environments in Practice: venv, Dependency Pinning and Cross-Platform Gotchas"Works on my machine" usually means mixed environments. This guide builds a clean flow with the stdlib venv: create, activate, pin and reproduce — plus the three frequent pitfalls: Windows activation, version drift and cross-platform dependencies.VSCode Remote Development: Remote-SSH Setup and Connection DebuggingA weak laptop, code on an intranet server, GPUs in the cluster — Remote-SSH keeps the UI local while code and terminal run remotely, feeling native. This guide covers setup, passwordless auth, common connection failures and experience tuning.
← Back to Guides