Key-based authentication proves identity for SSH connections with a cryptographic key pair rather than a password. The client keeps the private key under strict control, while the remote server stores the corresponding public key. This makes it suitable for PowerShell automation because passwords must be entered interactively and cannot be passed to New-PSSession or Invoke-Command. section 5.4.2
A practical SSH configuration separates authentication, key protection, and server identification:
- Enable PubkeyAuthentication on the SSH server; leave password authentication enabled temporarily while configuring the key. section 5.4.1
- Generate the client key pair with ssh-keygen, then add the private key to ssh-agent for additional protection. section 5.4.2
- Copy the public key into the remote user's authorized_keys file and restrict permissions on the SSH directory. section 5.4.2
- Confirm the remote host key on the first connection so it is recorded in known_hosts and recognized thereafter. section 5.4.2
- After key authentication works, disable PasswordAuthentication while retaining PubkeyAuthentication. section 5.4.2
Windows client to Linux server
Run ssh-keygen on the Windows client, load the private key with ssh-add, append the public key to the Linux user's authorized_keys file, and then invoke PowerShell remotely with Invoke-Command -HostName 'remotemachine' -UserName 'user' -ScriptBlock { $psversiontable }. section 5.4.2
ssh-keygen ssh-add "$($env:USERPROFILE)\.ssh\id_rsa"
Use the supplied command listing to generate a key pair and add its private key to the Windows SSH agent. section 5.4.2
type "$($env:USERPROFILE)\.ssh\id_rsa.pub" | ssh username@hostname "mkdir -p ~/.ssh && touch ~/.ssh/authorized_keys && chmod -R go= ~/.ssh && cat >> ~/.ss h/authorized_keys"
Use the supplied command listing to transfer the public key and create or update the remote authorized_keys file with restricted permissions. section 5.4.2
