There are three methods for SSH remote login authentication: Password, Keyboard Interactive, and Public Key.

The first two methods are password authentication, except that the first one does not require interaction, while the second one does. Generally, the first one is used because, compared to the second method, the first one only requires setting the username and password in the ssh terminal in advance to log in with one click. The third method, using public key authentication, is the most secure login method because the authentication information does not need to be transmitted over the Internet, and this is also the default method used by cloud servers.

Below are the specific setup steps.

Log in to the target Linux server as the root user, and enter the command to generate the public and private keys, as follows:

ssh-keygen -t rsa

Note: Here, the command is used to generate the public and private keys on the target Linux server, but this step does not actually have to be performed on the target server. You can also generate the public and private keys separately and then upload the public key to the target server (if there are a large number of servers that need to be uniformly configured for public key login, this method is the most suitable), for example, generating the public and private keys on the client system, and then using the command:

ssh-copy-id username@ip_address

Upload the public key to the authorized_keys file of the target host on the target server. Of course, you can also use third-party tools to generate public and private keys; just choose the method that suits you best.

File permission settings:

cd /root/.ssh
ls

You can see the generated RSA public key and private key:

chmod 700 /root/.ssh/
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

Add the public key to the ~/.ssh/authorized_keys file:

cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

Modify the configuration file of the sshd service to enable public key authentication:

vim /etc/ssh/sshd_config
--------------------------
PubkeyAuthentication yes   //去掉#并改为yes，其实如果没有修改过，这就是系统默认的配置

If you need to configure ssh public key login for the root user, you also need to make the following configuration:

vim /etc/ssh/ssh_config
----------------------------
#PermitRootLogin prohibit-password //去掉#

Remember to restart the ssh service after modifying the configuration file:

systemctl restart ssh

Finally, download the private key file ~/.ssh/id_rsa and import it into the corresponding ssh client that needs to log in to the target Linux server (or in the /.ssh folder under the user's home directory).

Note 1: In essence, it is simply that each ssh client uploads its own rsa public key to the authorized_keys file (whitelist) of the target Linux server, and then when logging in, the target Linux server uses the public key in the whitelist to verify the identity of each ssh client.

Note 2: The ssh-copy-id username@ip_address used in the article usually works fine when there is only a single SSH public key locally. However, in actual production environments, multiple public-private key pairs are often maintained locally. At this time, if the key file is not explicitly specified, ssh-copy-id may select an unexpected public key to write to the target host, resulting in authentication failure or failure to achieve the expected passwordless login effect. Therefore, it is recommended to explicitly specify the target public key file through the -i parameter when using it to ensure the correct deployment of the corresponding key and avoid login problems caused by inconsistent key selection.