Net::SS...ublicKey(3)

✨ NAME ✨

Net::SSH::Perl::Auth::PublicKey — bestie, this is the module that does publickey authentication 💅

okay so quick context: this page is Net::SS...ublicKey(3), and it lives in the User Contributed Perl Documentation corner of your perl manpages. yes the title is lowkey truncated, no that's not me being lazy, that's just how it ships 🙈

---

🌸 SYNOPSIS 🌸

use Net::SSH::Perl::Auth;
my $auth = Net::SSH::Perl::Auth->new('PublicKey', $ssh);
$auth->authenticate;

that's the whole vibe check. three lines. iconic. 👑

---

💖 DESCRIPTION 💖

Net::SSH::Perl::Auth::PublicKey does publickey authentication against a remote sshd server. fr fr that's the job description.

When you make a new PublicKey auth object, you hand it an $ssh object. That $ssh object should be holding an open connection to an ssh daemon, plus all the data the authentication module needs to do its thing. In this case, for example, $ssh might be carrying a list of identity files (go read the docs for Net::SSH::Perl if you wanna know more about that).

Now here's the plot. 🌈

The authenticate method first tries to establish a connection to an authentication agent. If that attempt works out, authenticate loops through each of the identities the agent handed back and tries every single one against the sshd — and the way it does that is a whole back-and-forth convo with the server:

1. the client sends the public portion of the key, to figure out whether the server will even accept it 👀
2. if the server accepts that key as authorization, the client then asks the agent to sign a piece of data using the key, and sends that signature over to the server
3. if the server accepts an identity/key, authentication is a success, we're done, slay 🎀

But not me assuming the agent is always gonna show up. 😭 If the agent connection attempt fails, or if none of the identities that came back from the agent actually get you authenticated, then authenticate switches lanes and tries to load each of the user's private key identity files instead. Those are the ones specified in the Net::SSH::Perl constructor, or defaulted to $ENV{HOME}/.ssh/id_dsa if you didn't specify any.

For each of those identities, authenticate gets into a dialog with the server. The client sends a message to the server containing its public key, plus a signature of the key and the other data in the message (session ID, etc. — yes all of it). That signature gets generated using the corresponding private key. 🔐

Then the sshd receives the message and verifies the signature using the client's public key. If the verification works, authentication succeeds. periodt.

also, a lil detail about loading those private key files: the client first tries to load the key using an empty passphrase. If that flops, the client either prompts the user for a passphrase (only if the session is interactive, bestie) or just skips that key altogether. no drama, moving on. 💅

---

🫶 AUTHOR & COPYRIGHTS 🫶

Please see the Net::SSH::Perl manpage for author, copyright, and license information. (I know, I know, they made you go look at another page — but that's where the receipts live. ✨)

---

and that's the whole page!! 🦋 thanks for reading to the end, bestie — this one's perl v5.42.0, dated 2026-01-17. go forth and authenticate responsibly 💜