SSH & Security

Setting Up SSH Key Authentication

Replace password-based SSH logins with cryptographic key pairs for secure, convenient server access.

Published Jan 20, 2025Updated May 15, 20266 min readBeginner

Table of Contents

Why Use SSH Keys?

SSH keys use public-key cryptography. Your private key stays on your local machine. The public key goes on the server. No private key = no access, even with the correct password. This eliminates brute-force password attacks entirely.

Step 1: Generate a Key Pair (on your local machine)

ssh-keygen -t ed25519 -C "your@email.com"

Press Enter for the default path (~/.ssh/id_ed25519). Add a passphrase for extra security.

💡 ed25519 is preferred over older RSA — shorter key, stronger security, faster authentication.

Step 2: Copy the Public Key to Your Server

Linux / Mac:

ssh-copy-id root@YOUR_SERVER_IP

Windows (PowerShell):

cat ~/.ssh/id_ed25519.pub | ssh root@YOUR_SERVER_IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Manual method: Copy the output of cat ~/.ssh/id_ed25519.pub, then on the server:

mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys   # paste your public key here
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

ssh root@YOUR_SERVER_IP

You should log in without a password prompt (only passphrase if you set one).

Step 4: Disable Password Authentication

⚠️ Do this ONLY after confirming key login works in a separate terminal window.

nano /etc/ssh/sshd_config

Find and change these lines:

PasswordAuthentication no
PermitRootLogin prohibit-password
ChallengeResponseAuthentication no

systemctl restart sshd

Step 5: SSH Config for Convenience

Create ~/.ssh/config on your local machine to save connection shortcuts:

Host myserver
  HostName YOUR_SERVER_IP
  User root
  IdentityFile ~/.ssh/id_ed25519

Now connect with just: ssh myserver

SSHSecurityKeysAuthentication

Was this article helpful?

How to Deploy Your First VPS

Setting Up UFW Firewall

Back to Knowledge Base