TL;DR SSH Key
An SSH key is a cryptographic authentication method used to securely connect to a server over the SSH protocol without requiring a password. SSH, which stands for Secure Shell, is the standard way to access a Linux server remotely via the command line. Traditional password authentication is vulnerable to brute force attacks because passwords can be guessed. SSH keys work differently. They come in pairs: a private key that stays on your computer and a public key that is placed on the server. When you connect, the server verifies your identity by checking that your private key matches the public key on file, without your private key ever leaving your machine. This makes SSH key authentication significantly more secure than passwords. CloudSonic servers use SSH key authentication only by default, with password login disabled at the server level from the moment the server is provisioned.
How an SSH Key Works
SSH key authentication uses asymmetric cryptography. When you generate an SSH key pair, you get two mathematically related keys: a private key that stays on your computer and a public key that can be shared freely. The public key is placed on the server in a file called authorized_keys. When you attempt to connect, the server generates a random challenge and encrypts it using your public key. Only the holder of the corresponding private key can decrypt this challenge. Your SSH client decrypts it using your private key and sends the result back to the server. The server verifies the response and if it matches, grants access. Your private key never leaves your machine and is never transmitted over the network. This is fundamentally more secure than password authentication because there is nothing to intercept, guess, or brute force. The private key can additionally be protected with a passphrase so that even if someone obtains the key file they cannot use it without knowing the passphrase.
# Generate a new SSH key pair (ED25519 is recommended)
ssh-keygen -t ed25519 -C "your@email.com"
# Copy your public key to a server (if password auth is temporarily enabled)
ssh-copy-id -p 2222 cloudsonic@your-server-ip
# Connect using your key
ssh -p 2222 cloudsonic@your-server-ip
# Connect using a specific key file
ssh -p 2222 -i ~/.ssh/id_ed25519 cloudsonic@your-server-ip
# View your public key (this is the one that goes on the server)
cat ~/.ssh/id_ed25519.pub
# Example authorized_keys entry on the server
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... your@email.com
Why SSH Keys Matter for Server Security
Password authentication for server access is fundamentally vulnerable because passwords can be guessed, stolen, phished, or leaked in data breaches. An SSH key cannot be guessed because it is a cryptographic key of sufficient length that brute force is computationally infeasible. It cannot be phished because it is never typed or transmitted. It cannot be leaked in a typical data breach because the private key never leaves your machine and is never stored on the server. The server only holds the public key, which is mathematically useless without the corresponding private key. For a server that is accessible from the public internet, the difference between password authentication and SSH key authentication is the difference between a door with a combination lock and a door with a cryptographic vault lock. CloudSonic disables password authentication entirely on every server from provisioning, meaning SSH key authentication is not optional, it is the only way in, which is the correct security posture for any production server.
