别把手机通行密钥当 SSH 密码：SSH 免密登录与 Passkey 的正确姿势

ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no <ssh-target> 'echo publickey-ok'

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no

powershell -ExecutionPolicy Bypass -File .\Setup-SshPasswordless-Windows11.ps1

powershell -ExecutionPolicy Bypass -File .\Setup-SshPasswordless-Windows11.ps1 -InstallPublicKey -Target "<ssh-target>"

param(
    [string]$KeyName = "id_ed25519_login",
    [string]$Target = "",
    [switch]$InstallPublicKey,
    [switch]$UseSecurityKey
)

$ErrorActionPreference = "Stop"
$ssh = Get-Command ssh -ErrorAction SilentlyContinue
$sshKeygen = Get-Command ssh-keygen -ErrorAction SilentlyContinue
if (-not $ssh -or -not $sshKeygen) {
    throw "OpenSSH Client is not available. Enable the Windows OpenSSH Client optional feature first."
}

$sshDir = Join-Path $HOME ".ssh"
New-Item -ItemType Directory -Force -Path $sshDir | Out-Null
$keyPath = Join-Path $sshDir $KeyName
$pubPath = "$keyPath.pub"
$keyType = $(if ($UseSecurityKey) { "ed25519-sk" } else { "ed25519" })

if (-not (Test-Path $keyPath)) {
    Write-Host "Generating $keyType key at $keyPath"
    & ssh-keygen -t $keyType -a 100 -f $keyPath -C "ssh-login-key"
} else {
    Write-Host "Key already exists: $keyPath"
}

try {
    Set-Service ssh-agent -StartupType Automatic
    Start-Service ssh-agent
    & ssh-add $keyPath
} catch {
    Write-Warning "Could not add key to ssh-agent automatically: $($_.Exception.Message)"
}

Write-Host "`nPublic key:"
Get-Content $pubPath

if ($InstallPublicKey) {
    if ([string]::IsNullOrWhiteSpace($Target)) {
        throw "Pass -Target '<ssh-target>' when using -InstallPublicKey."
    }
    Write-Host "`nInstalling public key to $Target"
    Get-Content $pubPath | ssh $Target 'umask 077; mkdir -p ~/.ssh; touch ~/.ssh/authorized_keys; cat >> ~/.ssh/authorized_keys; sort -u ~/.ssh/authorized_keys -o ~/.ssh/authorized_keys; chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys'
    Write-Host "`nTesting publickey-only login"
    ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no $Target 'echo publickey-ok'
}

Write-Host "`nDone. For website and app passkeys, use Windows Settings > Accounts > Passkeys or the target website security page."

bash setup-ssh-passwordless-ubuntu2604.sh

INSTALL_PUBLIC_KEY=1 REMOTE="<ssh-target>" bash setup-ssh-passwordless-ubuntu2604.sh

USE_SECURITY_KEY=1 bash setup-ssh-passwordless-ubuntu2604.sh

#!/usr/bin/env bash
set -euo pipefail

KEY_NAME="${KEY_NAME:-id_ed25519_login}"
REMOTE="${REMOTE:-}"
INSTALL_PUBLIC_KEY="${INSTALL_PUBLIC_KEY:-0}"
USE_SECURITY_KEY="${USE_SECURITY_KEY:-0}"
SSH_DIR="$HOME/.ssh"
KEY_PATH="$SSH_DIR/$KEY_NAME"
PUB_PATH="$KEY_PATH.pub"
KEY_TYPE="ed25519"

if [ "$USE_SECURITY_KEY" = "1" ]; then
  KEY_TYPE="ed25519-sk"
fi

command -v ssh >/dev/null || { echo "ssh is missing"; exit 1; }
command -v ssh-keygen >/dev/null || { echo "ssh-keygen is missing"; exit 1; }

mkdir -p "$SSH_DIR"
chmod 700 "$SSH_DIR"

if [ ! -f "$KEY_PATH" ]; then
  echo "Generating $KEY_TYPE key at $KEY_PATH"
  ssh-keygen -t "$KEY_TYPE" -a 100 -f "$KEY_PATH" -C "ssh-login-key"
else
  echo "Key already exists: $KEY_PATH"
fi

chmod 600 "$KEY_PATH"
chmod 644 "$PUB_PATH"

if command -v ssh-agent >/dev/null && command -v ssh-add >/dev/null; then
  if [ -z "${SSH_AUTH_SOCK:-}" ]; then
    eval "$(ssh-agent -s)" >/dev/null
  fi
  ssh-add "$KEY_PATH" || true
fi

echo
echo "Public key:"
cat "$PUB_PATH"

if [ "$INSTALL_PUBLIC_KEY" = "1" ]; then
  [ -n "$REMOTE" ] || { echo "Set REMOTE='<ssh-target>' first."; exit 1; }
  echo
  echo "Installing public key to $REMOTE"
  if command -v ssh-copy-id >/dev/null; then
    ssh-copy-id -i "$PUB_PATH" "$REMOTE"
  else
    cat "$PUB_PATH" | ssh "$REMOTE" 'umask 077; mkdir -p ~/.ssh; touch ~/.ssh/authorized_keys; cat >> ~/.ssh/authorized_keys; sort -u ~/.ssh/authorized_keys -o ~/.ssh/authorized_keys; chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys'
  fi
  echo
  echo "Testing publickey-only login"
  ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no "$REMOTE" 'echo publickey-ok'
fi

echo
echo "Done. Create website/app passkeys from each account security page; do not copy passkeys into SSH files."

zsh setup-ssh-passwordless-macos26.zsh

INSTALL_PUBLIC_KEY=1 REMOTE="<ssh-target>" zsh setup-ssh-passwordless-macos26.zsh

#!/usr/bin/env zsh
set -euo pipefail

KEY_NAME="${KEY_NAME:-id_ed25519_login}"
REMOTE="${REMOTE:-}"
INSTALL_PUBLIC_KEY="${INSTALL_PUBLIC_KEY:-0}"
USE_SECURITY_KEY="${USE_SECURITY_KEY:-0}"
SSH_DIR="$HOME/.ssh"
KEY_PATH="$SSH_DIR/$KEY_NAME"
PUB_PATH="$KEY_PATH.pub"
CONFIG_PATH="$SSH_DIR/config"
KEY_TYPE="ed25519"

if [[ "$USE_SECURITY_KEY" == "1" ]]; then
  KEY_TYPE="ed25519-sk"
fi

command -v ssh >/dev/null || { echo "ssh is missing"; exit 1; }
command -v ssh-keygen >/dev/null || { echo "ssh-keygen is missing"; exit 1; }

mkdir -p "$SSH_DIR"
chmod 700 "$SSH_DIR"

if [[ ! -f "$KEY_PATH" ]]; then
  echo "Generating $KEY_TYPE key at $KEY_PATH"
  ssh-keygen -t "$KEY_TYPE" -a 100 -f "$KEY_PATH" -C "ssh-login-key"
else
  echo "Key already exists: $KEY_PATH"
fi

chmod 600 "$KEY_PATH"
chmod 644 "$PUB_PATH"
touch "$CONFIG_PATH"
chmod 600 "$CONFIG_PATH"

if ! grep -q "UseKeychain yes" "$CONFIG_PATH"; then
  cat >> "$CONFIG_PATH" <<'EOF'

Host *
  AddKeysToAgent yes
  UseKeychain yes
EOF
fi

if command -v ssh-add >/dev/null; then
  ssh-add --apple-use-keychain "$KEY_PATH" 2>/dev/null || ssh-add -K "$KEY_PATH" 2>/dev/null || ssh-add "$KEY_PATH" || true
fi

echo
echo "Public key:"
cat "$PUB_PATH"

if [[ "$INSTALL_PUBLIC_KEY" == "1" ]]; then
  [[ -n "$REMOTE" ]] || { echo "Set REMOTE='<ssh-target>' first."; exit 1; }
  echo
  echo "Installing public key to $REMOTE"
  cat "$PUB_PATH" | ssh "$REMOTE" 'umask 077; mkdir -p ~/.ssh; touch ~/.ssh/authorized_keys; cat >> ~/.ssh/authorized_keys; sort -u ~/.ssh/authorized_keys -o ~/.ssh/authorized_keys; chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys'
  echo
  echo "Testing publickey-only login"
  ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no "$REMOTE" 'echo publickey-ok'
fi

echo
echo "Done. macOS passkeys are managed from Passwords and account security pages, not from ~/.ssh."

你是本机运维 Agent，请为当前这台客户端配置 SSH 免密登录。
要求：
1. 先识别系统是 Windows 11、Ubuntu 26.04 还是 macOS 26。
2. 只使用系统自带 OpenSSH 能力，不安装第三方云服务或未知工具。
3. 为当前设备生成独立 ed25519 SSH key；如果我明确要求并插入硬件安全钥匙，才尝试 ed25519-sk。
4. 私钥必须设置 passphrase；不要把私钥复制到任何远端。
5. 服务器端只追加公钥到 authorized_keys，不覆盖已有内容。
6. 全程不要输出真实内网 IP、完整计算机名、私有域名、私钥、密钥指纹以外的敏感内容。
7. 安装后用 PreferredAuthentications=publickey 和 PasswordAuthentication=no 做验证。
8. 只有在我明确确认后，才建议关闭服务器密码登录。