{"id":"6f6fac47-ecd5-43b6-99ec-d7873d7e804f","task":"Install a locally generated SSH public key on a remote server's authorized_keys so subsequent logins for that account succeed via public-key authentication instead of a password.","domain":"openssh.com","steps":["Confirm you have a local keypair to install, e.g. ~/.ssh/id_ed25519.pub (see the key-generation route if not); print it to verify with: cat ~/.ssh/id_ed25519.pub.","Fastest path if the `ssh-copy-id` helper is installed locally: ssh-copy-id -i ~/.ssh/id_ed25519.pub <user>@<host>. It will prompt for the account's current password, then append the key to the remote ~/.ssh/authorized_keys. (ssh-copy-id ships with many OpenSSH distributions but is not part of the core OpenBSD OpenSSH manual set, so fall back to the manual steps below if it is unavailable.)","Manual equivalent (works anywhere ssh/sshd are present): cat ~/.ssh/id_ed25519.pub | ssh <user>@<host> \"umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys\". This appends (never overwrite with a single >) your key without disturbing any keys already authorized.","On the remote host, set the permissions sshd requires: chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys, and make sure the home directory itself is not group/world-writable. sshd's default StrictModes=yes causes it to refuse to use authorized_keys if the file, ~/.ssh, or the home directory are writable by anyone but the owner.","Test from the client without touching the loaded agent key: ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no <user>@<host>. A successful login with no password prompt confirms the key is installed and readable by sshd.","If it still asks for a password, check the server's AuthorizedKeysFile directive in /etc/ssh/sshd_config -- default is \".ssh/authorized_keys .ssh/authorized_keys2\" relative to the home directory, but an admin may have pointed it elsewhere."],"gotchas":["sshd enforces StrictModes (default yes): a group/world-writable authorized_keys, ~/.ssh directory, or home directory makes sshd silently refuse to use the key, even though the file's contents are perfectly correct. Docs: https://man.openbsd.org/sshd.8 , https://man.openbsd.org/sshd_config.5","Always append (>>) to authorized_keys, never redirect with a single > -- that truncates the file and can lock out every other key already authorized for that account.","ssh-copy-id itself is not documented in the official OpenBSD OpenSSH manual pages; treat it as a convenience wrapper and fall back to the manual `cat | ssh ... >> authorized_keys` method, whose correctness is grounded in sshd(8)'s AUTHORIZED_KEYS FILE FORMAT section, if it's unavailable or behaves unexpectedly.","The public key file (id_ed25519.pub) is not sensitive and needs no special protection, but double-check you're copying the .pub file and not the private key by mistake.","If AuthorizedKeysFile has been changed in sshd_config (or set to 'none'), appending to ~/.ssh/authorized_keys will have no effect at all -- confirming the configured path requires running `sudo sshd -G | grep -i authorizedkeysfile` on the server (sshd(8)'s -G flag parses and prints the effective configuration), since the client has no visibility into it."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T22:39:36.722Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T22:39:36.722Z"},"url":"https://mcp.waymark.network/r/6f6fac47-ecd5-43b6-99ec-d7873d7e804f"}