How is public-key cryptography secure? Quite strange question, but here goes:

I don't quite understand how asymmetric encryption works. Take SSH for an example: The server will always be listening for commands, so anyone who has the public key (easily obtained as I understand (I might be wrong)) can send commands to the server and it would appear as if the correct client had sent them? I know there must be a catch but I can't seem to figure it out. Even if SSH used symmetric keys, the exchange of those keys uses asymmetric keys so a man-in-the-middle could tell the server it's password instead of the real one?

Sorry if this is a little rambley, it's quite hard for me to explain.

Thanks in advance.
Take SSH for an example: The server will always be listening for commands, so anyone who has the public key (easily obtained as I understand (I might be wrong)) can send commands to the server and it would appear as if the correct client had sent them? 


You are confused indeed, but you are drawing a strictly correct inference here: the server's public key is of no use for the server to tell authorized clients apart from attackers. But it's not meant to do that; the server public key is meant to provide two things:


Allow the client to authenticate the server (so that an attacker can't impersonate the server);
Allow the client to bootstrap an encrypted channel with the server.


So what follows is that, in addition to its public key, the server needs some other mechanism to authenticate the clients.  The most common ones are familiar:


The server asks the client for a username and password
The user has their own public key registered with their account in the server (in most implementations, in their ~/.ssh/authorized_keys), and the client and server execute a challenge-response protocol to allow the client to prove they possess the corresponding private key.