SSH as a mental model

What you will be able to do

• Describe what SSH is for in DE and AI work
• Read the parts of ssh user@host
• Generate an SSH key locally without connecting to a remote server

Why this matters for DE and AI

The GPU box is not under your desk. The Spark history server is not a website you invent. You SSH into a Linux machine in a data center: a text login over an encrypted connection. After you are in, every lesson in this module still applies — same ls, same df, same logs.

This lesson does not require a cloud account. You will only create a key on your laptop.

Concepts

your laptop  --ssh-->  cloud VM (Linux)
                 |
                 +-->  GPU box
                 +-->  a colleague's "dev" server

Command shape:

ssh USER@HOST

• USER — Linux username on the remote machine (ubuntu, ec2-user, or one your team gave you).
• HOST — a name or IP address (10.0.0.12, gpu-01.example.com).

You will also see ssh -i ~/.ssh/some-key.pem USER@HOST when a cloud console gives you a key file.

Keys vs passwords

A password is what you type. Many servers disable it.

An SSH key is a pair of files:

• Private key — stays on your machine. Never share. Never commit. Names like id_ed25519 (no .pub).
• Public key — id_ed25519.pub. You can paste this into GitHub or a cloud “authorized keys” field.

ssh-keygen creates the pair.

We will not connect to a real host in v1. Generating a key is enough to know what teams mean by “send me your public key.”

Practice on your machine

Check whether you already have a key:

ls -la ~/.ssh

If you see id_ed25519 and id_ed25519.pub (or id_rsa and id_rsa.pub), do not overwrite them. Skip ssh-keygen and only list the .pub file:

cat ~/.ssh/id_ed25519.pub

or cat ~/.ssh/id_rsa.pub. That line is safe to show on your own screen. It starts with ssh-ed25519 or ssh-rsa.

If ~/.ssh is empty or has no key pair, create one. Press Enter to accept the default path. You can set a passphrase (recommended) or empty for local learning — a passphrase means a stolen disk does not steal the key.

ssh-keygen -t ed25519 -C "dcubes-learning"

If ed25519 is rejected (very old systems), use:

ssh-keygen -t rsa -b 4096 -C "dcubes-learning"

Then:

ls -l ~/.ssh

What you should see: a private file without .pub, mode -rw------- (only you), and a .pub file.

cat ~/.ssh/id_ed25519.pub

One long line. That is what you would give a cloud console later.

Common mistakes

• Running ssh-keygen twice and overwriting. It asks before overwrite. Say no if you already use GitHub.
• Copying the private key. If it is not .pub, it is not for sharing.
• Thinking you must rent a VM today. You do not. Docker and Compose are next on the roadmap; SSH will return when we talk to remote machines.

Next

Capstone: First data shift — one local lab using the CSV, the log, pipes, and disk.