HomeTagsAboutSearch
#ssh#linux#security#tutorial#server

How to Set Up SSH Keys (Passwordless Login)

4 min read

Original Source: How to Set Up SSH Keys (Passwordless Login) — SamNet Learn

Prerequisites

  • A server with SSH access
  • Terminal access on your local machine

Quick Answer: Run ssh-keygen -t ed25519 on your local machine. Then ssh-copy-id user@server to copy the key. Now ssh user@server logs in without a password. Disable password auth in /etc/ssh/sshd_config by setting PasswordAuthentication no.

Need a VPS? Vultr (free credit), DigitalOcean ($200 free credit), or RackNerd (cheap annual deals).

Why SSH Keys?

| | Password | SSH Key | | :---------------- | :----------------------- | :------------------------- | | Security | Can be brute-forced | Nearly impossible to crack | | Convenience | Type password every time | Automatic login | | Automation | Can't automate securely | Scripts can use keys | | Best practice | Discouraged for servers | Industry standard |

Step 1: Generate a Key Pair

On your local machine (not the server):

ssh-keygen -t ed25519 -C "your@email.com"
  • -t ed25519 — Modern, secure algorithm (preferred over RSA)
  • -C — Comment to identify the key

It asks:

Enter file in which to save the key (/home/you/.ssh/id_ed25519):

Press Enter to accept the default location.

Enter passphrase (empty for no passphrase):

Optional but recommended — adds a password to the key itself. If someone steals your key file, they still need the passphrase.

This creates two files:

| File | What | Share it? | | :---------------------- | :---------- | :------------------- | | ~/.ssh/id_ed25519 | Private key | NEVER share this | | ~/.ssh/id_ed25519.pub | Public key | Copy to servers |

If You Need RSA (older servers)

ssh-keygen -t rsa -b 4096 -C "your@email.com"

Step 2: Copy the Key to Your Server

Method 1: ssh-copy-id (Easiest)

ssh-copy-id user@your-server-ip

Type your password one last time. It copies the public key to the server's ~/.ssh/authorized_keys file.

Method 2: Manual Copy

If ssh-copy-id is not available:

# Display your public key
cat ~/.ssh/id_ed25519.pub

# SSH into the server with password
ssh user@your-server-ip

# On the server, add the key
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "PASTE_YOUR_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Method 3: From Windows (PowerShell)

# Generate key (if not done)
ssh-keygen -t ed25519

# Copy key to server
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Step 3: Test It

ssh user@your-server-ip

You should log in without typing a password. If it still asks for a password, check permissions:

# On the server
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R $USER:$USER ~/.ssh

Step 4: Disable Password Login (Recommended)

Once key auth works, disable password login to prevent brute-force attacks:

# On the server, edit SSH config
sudo nano /etc/ssh/sshd_config

Change these settings:

PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no

Restart SSH:

sudo systemctl restart sshd

⚠️ Keep your current SSH session open while testing with a new terminal. If something goes wrong, you can fix it from the existing session.

Multiple Keys

Different Keys for Different Servers

# Generate a key for work
ssh-keygen -t ed25519 -f ~/.ssh/id_work -C "work@company.com"

# Generate a key for personal
ssh-keygen -t ed25519 -f ~/.ssh/id_personal -C "personal@email.com"

Configure in ~/.ssh/config:

Host work-server
    HostName 10.0.0.5
    User admin
    IdentityFile ~/.ssh/id_work

Host personal-vps
    HostName 203.0.113.50
    User sam
    IdentityFile ~/.ssh/id_personal

Now just: ssh work-server or ssh personal-vps

Add Key to SSH Agent

To avoid typing the passphrase every time:

# Start the agent
eval "$(ssh-agent -s)"

# Add your key
ssh-add ~/.ssh/id_ed25519

# List loaded keys
ssh-add -l

Troubleshooting

| Problem | Fix | | :----------------------------------- | :----------------------------------------------------------- | | Still asks for password | Check permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys | | Permission denied (publickey) | Key not on server, or wrong user. Check ~/.ssh/authorized_keys on server | | Agent refused connection | Run eval "$(ssh-agent -s)" then ssh-add | | Key file too open | chmod 600 ~/.ssh/id_ed25519 — SSH refuses keys with loose permissions | | Wrong key being used | Specify key: ssh -i ~/.ssh/id_specific user@server | | Locked out after disabling passwords | Use server console (cloud provider's web terminal) to re-enable |

# Debug SSH connection
ssh -v user@server              # Verbose — shows what key is tried
ssh -vvv user@server            # Extra verbose

See Also

📖 Original Source: How to Set Up SSH Keys (Passwordless Login) by SamNet Learn.

Comments