Explain how user authentication on the server is performed using SSH keys.

User authentication using SSH keys is based on the use of a key pair: a private key (stored on the user) and a public key (placed on the server). When attempting to connect, the client sends a request to the server, which checks for the user's public key in the ~/.ssh/authorized_keys file. If the key is found, the server generates a random string (challenge), which the client must encrypt with its private key and send back. The server decrypts the response using the public key, and if the data matches, authentication is considered successful.

This allows secure passwordless login, as the private key is not transmitted over the network and is protected by a password or stored securely.

Setup example:

1. Generate keys on the client:

ssh-keygen -t rsa -b 4096

2. Copy the public key to the server:

ssh-copy-id user@server

3. Connect to the server:

ssh user@server

If everything is set up correctly, no password will be required.