Skip to main content

Lab 8: The Command Line

Published

2026-11-06

This lab answers the chapter 8 comprehension questions and illustrates how SSH key authentication works.

Comprehension questions

“Draw a mental map that includes the following: terminal, shell, theme manager, operating system, my laptop.”

%%{init: {'theme': 'base', 'look': 'classic', 'themeVariables': {'fontFamily': 'monospace'}}}%%

graph TD
    Laptop(["<strong>Laptop</strong><br/><em>(Hardware)</em>"])
    OS("<strong>Operating System</strong><br/><em>(macOS, Linux,<br>Windows)</em>")
    Shell("<strong>Shell</strong><br/><em>(bash, zsh, fish)</em>")
    Terminal("<strong>Terminal</strong><br/><em>(Application)</em>")
    Theme("<strong>Theme Manager</strong><br/><em>(Appearance settings)</em>")

    Laptop --> OS
    OS --> Shell
    OS --> Theme
    Shell --> Terminal
    Theme --> Terminal

    style Laptop fill:#5B8C5A,stroke:#000000,stroke-width:1px,color:#ffffff
    style OS fill:#1B2A41,stroke:#000000,stroke-width:1px,color:#ffffff
    style Shell fill:#2A6F77,stroke:#000000,stroke-width:1px,color:#ffffff
    style Terminal fill:#D2562B,stroke:#000000,stroke-width:1px,color:#ffffff
    style Theme fill:#E8A33D,stroke:#000000,stroke-width:1px,color:#ffffff

System Architecture: Layers and Components

“Under what circumstances should you move or share your SSH private key? (Hint: this is a trick question.)”

Never. A private key is like the password to our entire identity on remote systems. If someone gains access to it, they can impersonate us, access our servers, and compromise our systems.

The only place a private key should exist is on machines we own and control. If we suspect a private key has been compromised, generate a new key pair immediately and update the corresponding public key on all remote systems.

“What is it about SSH public keys that makes them safe to share?”

SSH public keys are safe to share because the math behind each key pair (typically Ed25519 or RSA) only works in one direction: given a public key, it’s computationally infeasible to calculate the corresponding private key. A server uses our public key to verify signatures that only our private key can create, so we can distribute the public key anywhere (GitHub, servers, etc.) without exposing the private key.

SSH Key Authentication Flow

Here’s how SSH keys work in practice when we authenticate to a remote server. The server never sees our private key. It asks the client to sign some session data with the private key, then checks that signature against our public key. This proves we own the private key without ever transmitting it.

%%{init: {'theme': 'base', 'look': 'classic', 'themeVariables': {'fontFamily': 'monospace'}}}%%

sequenceDiagram
    actor User as Developer
    participant Client as Client Machine
    participant Server as Remote Server

    User->>Client: ssh user@server.com
    Client->>Server: Initiate connection
    Server->>Client: Send server public key
    Client->>Client: Verify server identity
    Client->>Server: Offer client public key
    Server->>Server: Look up authorized_keys
    alt Public key found
        Server->>Client: Challenge (sign session data)
        Client->>Client: Sign with private key
        Client->>Server: Send signature
        Server->>Server: Verify signature with public key
        Server->>Client: ✓ Authentication successful
        Client->>User: Connected
    else Public key not found
        Server->>Client: ✗ Authentication failed
        Client->>User: Permission denied
    end

SSH Key Authentication Sequence

Recap

  1. A private key never moves and is never shared. It should only exist on machines we own and control, and if we suspect it’s been compromised, we generate a new key pair and update the public key on every remote system.

  2. A public key is safe to share because the relationship only runs in one direction: it’s computationally infeasible to calculate the private key from the public key.

  3. The server never sees the private key during authentication. It checks a signature made with the private key against the public key in authorized_keys, which proves we own the private key without transmitting it.

In AWS Server Login we’ll use an SSH key pair to log into our EC2 instance.