SSH Key Pair & Agent Forwarding

The purpose of an SSH Key is to be able to login securely without having to enter the password of each remote server all the time. You will get access because you own the private key matching one of the public keys added to the server. With Agent Forwarding it gets even better: On your hosting account you will be able to connect to other SSH services like GitHub without having to enter a password.

In this explanation we only target MacOS and Linux users.

• On Windows, you can install Ubuntu so you have a good Linux terminal.
• You can find an explanation on how to do the same on Windows using Putty.

Generate an SSH Key Pair

To be able to use SSH Agent Forwarding, you will need a SSH Key Pair: a private and public key pair that only one person owns. Use the following command in your terminal to generate an Ed25519-type key pair.

ssh-keygen -t ed25519 -C "your_email@example.com"

This command should also prompt for a passphrase which would be known by you only. 

The generated public key will be in ~/.ssh/id_ed25519.pub and the private one in ~/.ssh/id_ed25519. 

Never share the private key with anyone else. The public key can be added to the file ~/.ssh/authorized_keys on a remote server.

Test the SSH Key Pair

Before testing, ensure you have successfully added your public key on the remote server. Now connect to your hosting account using SSH. It may ask for your passphrase but should not ask for an SSH password. Example:

ssh -p2222 [user]@[server].[domain.tld]

Enable Agent Forwarding

To enable agent forwarding, create/edit the file ~/.ssh/config using commands like these:

mkdir -p ~/.ssh
nano ~/.ssh/config

Add this on top of the file:

Host * 
 ServerAliveInterval 300 
 TCPKeepAlive yes 
 ForwardAgent yes 
 GSSAPIAuthentication yes 
 Protocol 2 
 AddKeysToAgent yes

If you're using Nano, exit it with Ctrl-X.

Test Agent Forwarding

Firstly, connect to your hosting account:

ssh -p2222 [user]@[server].[domain.tld]

Next, if you have added your public SSH key to your GitHub account (https://github.com/settings/keys), test if you can login without entering a password. For GitHub the SSH user is always git. Example:

ssh -q git@github.com

GitHub should respond with this line: "Hi [user]! You've successfully authenticated, but GitHub does not provide shell access."