Set up SSH keys

SSH keys replace passwords with a key pair. The private key stays on your computer and the public key goes on the server. Keys are far harder to guess than any password, and once they are set up you log in without typing one.

1. Create a key pair on your computer

macOS, Linux and Windows 10 or 11 (PowerShell) all include OpenSSH. Run:

ssh-keygen -t ed25519 -C "you@laptop"

Press Enter to accept the default file location. When asked, set a passphrase. It protects the key if your computer is ever stolen.

This creates two files in the .ssh folder in your home directory:

• id_ed25519 is the private key. Never share it or upload it anywhere.
• id_ed25519.pub is the public key. This one is safe to copy to servers.

2. Copy the public key to your server

On macOS and Linux:

ssh-copy-id root@203.0.113.25

On Windows PowerShell, which has no ssh-copy-id:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@203.0.113.25 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Enter the server password one last time.

3. Test the key

ssh root@203.0.113.25

You should be asked for your key's passphrase, if you set one, and not the server password.

4. Turn off password logins (optional)

Open the SSH server configuration:

nano /etc/ssh/sshd_config

Set this line (remove the # in front if there is one):

PasswordAuthentication no

Some images also set this option in a file under /etc/ssh/sshd_config.d/, and that file can override your change. Check with:

grep -ri passwordauthentication /etc/ssh/sshd_config.d/

Check the configuration for mistakes, then reload SSH. On Debian and Ubuntu the service is called ssh. On RHEL-based systems it is sshd.

sshd -t && systemctl reload ssh

Using more than one computer

Create a separate key on each device and add each public key as its own line in ~/.ssh/authorized_keys. If you lose a device, delete only that line.