bhylu.com

Advertisements

Git SSH Authentication

SSH can authenticate a connection to a Git host using a key pair. The public key can be registered with a host; the private key must remain protected.

How it works

This exercise writes a fictional SSH configuration as a reading fixture outside the repository and checks that it was not committed. It does not read your existing SSH folder, generate a key, modify known_hosts or connect to GitHub. For a real setup follow the host’s key instructions, use an appropriate passphrase/agent policy and verify the host fingerprint before trusting a new server.

Run the disposable lab

Use Windows PowerShell 5.1 or later and Git 2.28 or later. The reviewed CLI is Git for Windows 2.53.0.windows.2. These are PowerShell examples, not Git Bash commands. Save the download as ssh.ps1 in a separate empty learning folder and run it in a separate process: powershell -NoProfile -ExecutionPolicy Bypass -File .\ssh.ps1. The execution-policy option applies to that process, not your machine policy.

The script creates bhylu-git-ssh and refuses an existing folder. It supplies two fictional seed files and repository-local settings, then runs the lesson commands. The literal separator is quoted as '--' so PowerShell passes it through the guard. A guard function named git calls the real CLI and stops on unexpected failures; Expect-GitFailure checks deliberately refused operations. Child-process configuration isolates your personal Git settings. File transports are allowed only for owned local remotes; internet transports are disabled in this lab. No hosting account, Apache or MySQL service is required. There is no Git playground. Leave the generated folder for inspection; choose another empty parent to run again.

Test boundary: SSH configuration reading only; no authentication or live host connection.

Download the complete ssh.ps1 lab

Example

ssh.ps1

# Bhylu Git lab: SSH Authentication
# Run in a separate PowerShell process, in an empty learning folder.
# Existing lab folders are refused; nothing is pushed to an internet host.
$ErrorActionPreference = 'Stop'
$script:GitExe = (Get-Command git -CommandType Application | Select-Object -First 1).Source
$script:LabRoot = Join-Path (Get-Location) 'bhylu-git-ssh'
if (Test-Path -LiteralPath $script:LabRoot) { throw 'Lab folder already exists. Choose another empty parent folder.' }
New-Item -ItemType Directory -Path $script:LabRoot | Out-Null
$env:GIT_CONFIG_NOSYSTEM = '1'
$env:GIT_CONFIG_GLOBAL = Join-Path $script:LabRoot 'empty-global-config'
[IO.File]::WriteAllText($env:GIT_CONFIG_GLOBAL, '')
$env:GIT_TERMINAL_PROMPT = '0'
$env:GIT_EDITOR = 'true'
$env:GIT_SEQUENCE_EDITOR = 'true'
$env:GIT_AUTHOR_DATE = '2026-01-10T10:00:00+00:00'
$env:GIT_COMMITTER_DATE = $env:GIT_AUTHOR_DATE
function git {
    & $script:GitExe -c protocol.allow=never -c protocol.file.allow=always @args
    if ($LASTEXITCODE -ne 0) { throw "Git exited with code $LASTEXITCODE" }
}
function Expect-GitFailure {
    & $script:GitExe -c protocol.allow=never -c protocol.file.allow=always @args
    if ($LASTEXITCODE -eq 0) { throw 'Expected Git to refuse this operation' }
}
function Assert-Equal($Actual, $Expected) {
    if ((($Actual | Out-String).Trim()) -cne (($Expected | Out-String).Trim())) { throw "Expected [$Expected], got [$Actual]" }
}
function Write-LabFile([string]$Name, [string]$Text) {
    $target = [IO.Path]::GetFullPath((Join-Path (Get-Location) $Name))
    if (!$target.StartsWith($script:LabRoot + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { throw 'Path outside lab' }
    [IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($target)) | Out-Null
    [IO.File]::WriteAllText($target, ($Text.Replace('\n', "`n") + "`n"), (New-Object Text.UTF8Encoding($false)))
}
function New-LabRepo([string]$Name) {
    New-Item -ItemType Directory -Path $Name | Out-Null
    Push-Location $Name
    try {
        git init --initial-branch=main
        git config --local user.name 'Repair Lab'
        git config --local user.email 'repair@example.invalid'
        git config --local core.autocrlf false
        git config --local commit.gpgSign false
        git config --local tag.gpgSign false
        git config --local core.hooksPath (Join-Path $script:LabRoot 'empty-hooks')
        Write-LabFile 'notes.md' 'Inspect hinge'
        Write-LabFile 'tasks.txt' 'desk=open'
        git add '--' notes.md tasks.txt
        git commit -m 'Record initial repair plan'
    } finally { Pop-Location }
}
Push-Location $script:LabRoot
try {
    New-LabRepo 'desk'
    Set-Location desk
    Write-LabFile '../ssh-config-example.txt' 'Host repair-host\n    HostName github.com\n    User git\n    IdentityFile ~/.ssh/your-key\n    IdentitiesOnly yes'
    Assert-Equal (git ls-files '--' ssh-config-example.txt) @('')
    $example = Get-Content ../ssh-config-example.txt -Raw
    if ($example -notmatch 'IdentitiesOnly yes') { throw 'Expected explicit identity policy' }
    Write-Output 'Verified: ssh'
} finally { Pop-Location }
Focus on the lesson commands

This excerpt omits the seed repository and guard helpers. Use the complete download to run it.

Lesson excerpt

Write-LabFile '../ssh-config-example.txt' 'Host repair-host\n    HostName github.com\n    User git\n    IdentityFile ~/.ssh/your-key\n    IdentitiesOnly yes'
Assert-Equal (git ls-files '--' ssh-config-example.txt) @('')
$example = Get-Content ../ssh-config-example.txt -Raw
if ($example -notmatch 'IdentitiesOnly yes') { throw 'Expected explicit identity policy' }

Expected result

A separate text fixture describes an SSH host alias. No real credentials or SSH settings are changed.

The complete script ends with Verified: ssh only after its checks pass. Object IDs, temporary paths and progress output can differ.

A successful SSH authentication test and permission to write a particular repository are different checks. HTTPS with a suitable credential manager is another transport choice. Never put an access token in a public URL, lesson screenshot or committed configuration file.

Official reference

Advertisements