Network › Module 9 › Lesson 2
SSH Keys vs Passwords
Keys are identities you can file and revoke — practice keys later in cyberlium-lab, not a hydra lab.
Visual · ssh_keys_vs_passwords
SSH passwords guess; keys attest. NEVER hydra SSH.
Opening
A password is a shared secret you type. An SSH key is a keypair you can store, pin, and shred.
Password SSH fails the internet's favorite way: people reuse logins, and attackers guess. Public-key SSH fails differently: you protect a private file, you install a public file on servers you own, you revoke by deleting that public line. Neither magic-erases malware on the box. Both are better understood than “I hydra'd until it opened.” Original Cyberlium.
1. What each secret actually is
A password authenticator is something you can type and something a log can leak. An Ed25519 keypair is a private file (keep it 600, never paste it into Discord) and a public file you may place in authorized_keys on machines you administer.
Passphrases on keys protect the private file at rest. They are not the same as the server account password. Mixing those two sentences is how people disable keys “because login was confusing.”
Command guide
What each secret actually is
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssh-client
macOS: Built-in
Windows: Built-in (OpenSSH)
═══ LINUX / macOS ═══
View SSH client config
Command — copy this
ssh -G localhost ssh -G localhost | grep -i 'identityfile\|passwordauthentication'
Generate an Ed25519 key pair
Command — copy this
ssh-keygen -t ed25519 -C '[email protected]' ssh-keygen -t ed25519 -f ~/.ssh/practice_key -C 'lab key'
View public key
Command — copy this
cat ~/.ssh/id_ed25519.pub
Optional command
Copy public key to a server
Command — copy this
ssh-copy-id user@server
═══ WINDOWS ═══
Optional command
PowerShell (OpenSSH built-in)
Command — copy this
ssh -G localhost ssh-keygen -t ed25519 -C '[email protected]' Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub
Optional command
Copy key to server
Command — copy this
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@server "cat >> ~/.ssh/authorized_keys"
2. Look, do not brute-force
ssh -G can print effective client config for a dummy host without connecting. That is literacy. Connecting to 127.0.0.1 is only for a server you run. Guessing against anyone else's :22 is hydra culture and is refused.
If you have no ssh binary, write that. Do not download a brute-force suite “so the lesson works.”
3. Where keys will live in this topic
The lab generates $HOME/cyberlium-lab/t11_practice_ed25519. That path is on purpose: it will not silently overwrite ~/.ssh/id_ed25519. If a blog says ssh-keygen with the default path, you still add -f to the practice file unless the human at the keyboard clearly asked to rotate their real key.
You will not copy the practice private key to a server on a café. You will not paste it into the course chat.
4. What you ship: keys vs passwords in writing, hydra refused
Model file. ssh -G literacy if present. Practice path named. No hydra. No /24 port 22. No silent overwrite of real id_ed25519. DEMO GATE holds.
5. What you record before the next lesson
t11-m09-l02-model.txt. DEMO identified/STOP. SAFE NEVER hydra SSH. Next: Hardening YOUR SSH Config.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
hydra -l root -P rockyou -s 22 a classmate. nmap -p22 192.168.0.0/24. ssh-keygen with default path over a real key “because the lab said ed25519.”
Right
Write the comparison. Leave brute force in the bin. Next: Hardening YOUR SSH Config.
Mission: prefer keys in writing, not guesses in a loop
1) / STOP if router. 2) Write password vs pubkey vs passphrase. 3) Note the practice key path for L04. Never hydra. Never scan :22 on a /24.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor what authorized_keys is on a VM you own — not which hydra flags “work in HTB.”
Knowledge Check
APPLY: Fastest way to fail this academy's SSH ethics?
Multiple choice
Knowledge Check
APPLY: True or False: A key passphrase is the same as the server's account password.
True or False
Knowledge Check
APPLY: Default ssh-keygen path risk this topic cares about:
Multiple choice