How to Set Up SSH Key-Based Authentication on Linux (Step-by-Step)
Replace passwords with SSH keys: generate an Ed25519 key pair, copy the public key to your server, test the login and then turn off password authentication to block brute-force attacks.
ssh-keygen -t ed25519 on your computer, copy the public key with ssh-copy-id user@server, test the login, and then set PasswordAuthentication no in /etc/ssh/sshd_config and restart SSH.Safer Logins Without Typing Server Passwords
Passwords can be guessed, reused or stolen. An SSH key pair is far harder to attack, and once it is set up you can log in faster. This guide covers the whole process, from creating the key to locking down the server.
Generate a Key Pair
Create an Ed25519 key with a passphrase using ssh-keygen.
Copy the Public Key
Use ssh-copy-id to authorize it on your server.
Disable Passwords
Turn off password logins once key login works.
How SSH Key Authentication Works
SSH key-based authentication uses a pair of mathematically linked keys. The private key stays on your computer and must never be shared. The public key is placed on every server that you want to log in to. When you connect, the server uses the public key to challenge your client, and your client proves that it holds the matching private key without ever sending it over the network.
| File | Purpose | Recommended permissions |
|---|---|---|
~/.ssh/id_ed25519 | Your private key. Keep it secret. | 600 |
~/.ssh/id_ed25519.pub | Your public key. Safe to share. | 644 |
~/.ssh/authorized_keys (on the server) | List of public keys allowed to log in | 600 |
~/.ssh (directory) | Holds the SSH files | 700 |
Which key type should you choose?
| Type | When to use it |
|---|---|
| Ed25519 | The best default for modern systems: short keys, fast and strong |
| RSA (3072 or 4096 bits) | A compatibility fallback for older servers and software |
| Ed25519-sk (security key) | When you want the key bound to a FIDO2 hardware token |
Requirements
- A Linux server that runs the OpenSSH server, and a working password login to start with
- A client computer with OpenSSH (Linux, macOS, or Windows 10/11 with the OpenSSH client)
- A user account on the server that you want to log in to
- Console or recovery access, in case you make a mistake in
sshd_config
If your server uses a non-standard port, add -p to the commands below. See our guide on how to SSH with a different port.
Step 1: Check for Existing Keys
List your current keys
On your client computer, check whether you already have a key pair:
ls -al ~/.ssh/*.pubIf a file such as id_ed25519.pub exists and you still use it, you can skip to Step 3. Do not overwrite an existing key that other servers rely on.
Step 2: Generate an SSH Key Pair
Create an Ed25519 key
ssh-keygen -t ed25519 -C "khurram@laptop"Press Enter to accept the default file location. When prompted, enter a strong passphrase. The comment after -C helps you recognize the key later.
If you must support an older system that does not accept Ed25519, create an RSA key instead:
ssh-keygen -t rsa -b 4096 -C "khurram@laptop"Step 3: Copy the Public Key to the Server
Use ssh-copy-id
ssh-copy-id user@server-ipEnter your account password once when asked. The tool appends your public key to ~/.ssh/authorized_keys on the server and sets safe permissions. For a specific key or a custom port, use:
ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 2222 user@server-ipManual method (if ssh-copy-id is not available)
cat ~/.ssh/id_ed25519.pub | ssh user@server-ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"Step 4: Test the Key Login
Connect with the key
ssh user@server-ipYou should be asked for your key passphrase (or nothing if the agent holds it), not the account password. To see exactly which key is used, add verbose mode:
ssh -v user@server-ipLook for a line that says authentication succeeded with publickey.
Step 5: Use ssh-agent and ~/.ssh/config
Load the key into ssh-agent
The agent keeps your decrypted key in memory so you type the passphrase only once per session:
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519Many desktop environments start an agent for you automatically.
Save the settings in your SSH config
nano ~/.ssh/configHost myserver
HostName 192.168.1.10
User khurram
IdentityFile ~/.ssh/id_ed25519
IdentitiesOnly yesNow you can connect with ssh myserver. IdentitiesOnly yes tells SSH to offer only this key, which avoids “too many authentication failures” when your agent holds many keys.
Step 6: Disable Password Authentication
Once key login works, turning off passwords removes the main target for brute-force attacks. Work from the console or keep a second session open.
Edit the SSH server configuration
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo nano /etc/ssh/sshd_configSet these options:
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-passwordPermitRootLogin prohibit-password allows root only with a key. Use no if you do not need root logins at all. On older systems the keyboard-interactive option is named ChallengeResponseAuthentication.
/etc/ssh/sshd_config.d/ that can switch password authentication back on. List them with ls /etc/ssh/sshd_config.d/ and check the effective value later with sudo sshd -T | grep -i passwordauthentication.Validate and restart SSH
sudo sshd -t
# Debian / Ubuntu
sudo systemctl restart ssh
# RHEL / Rocky / AlmaLinux / Fedora
sudo systemctl restart sshdNo output from sshd -t means the file is valid.
Step 7: Verify the Final Setup
Open a new terminal and confirm both results:
# Should succeed with your key
ssh user@server-ip
# Should be refused: "Permission denied (publickey)"
ssh -o PubkeyAuthentication=no user@server-ipIf the second command still asks for a password, password authentication is not fully disabled. Recheck sshd_config.d and the effective settings.
SSH Keys from Windows
Windows 10, Windows 11 and Windows Server include the OpenSSH client, so you can generate keys in PowerShell with the same command:
ssh-keygen -t ed25519Windows has no ssh-copy-id, so copy the key to a Linux server like this:
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@server-ip "cat >> ~/.ssh/authorized_keys"Run the earlier mkdir and chmod commands on the server first if ~/.ssh does not exist yet. PuTTY users can generate a key with PuTTYgen and load it in PuTTY’s Auth settings. To use keys with the OpenSSH server on Windows, see Microsoft’s OpenSSH key management guide.
Best Practices
- Always protect the private key with a strong passphrase
- Never copy or send a private key. Only share the
.pubfile - Use a separate key for each computer, so that you can revoke one without affecting the others
- Remove a lost or retired key by deleting its line from
authorized_keys - Back up your private key in a secure place, such as an encrypted password manager or vault
- Consider a hardware security key for administrator accounts
- Keep OpenSSH and your operating system up to date
- Monitor your network for unknown devices. See our guide to network monitoring tutorials
Troubleshooting
Permission denied (publickey)
Check that the right public key is in authorized_keys, that you log in as the right user and that the file permissions are correct. Run ssh -vvv user@server-ip for details.
Still asked for a password
The server may not accept your key. Check permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys, and make sure the home directory is not writable by other users.
Unprotected private key file
SSH refuses a private key that others can read. Fix it with chmod 600 ~/.ssh/id_ed25519.
Too many authentication failures
Your agent offers too many keys. Use IdentitiesOnly yes and an IdentityFile line in your config.
SELinux blocks the key (RHEL-based)
Restore the correct labels with restorecon -Rv ~/.ssh on the server.
Check the server logs
Use sudo journalctl -u ssh (Debian and Ubuntu) or sudo journalctl -u sshd (RHEL-based). Some systems also log to /var/log/auth.log or /var/log/secure.
For more detail, read the OpenSSH manual pages for ssh-keygen, ssh-copy-id and sshd_config.
Frequently Asked Questions
What is SSH key-based authentication?
It is a login method that uses a cryptographic key pair instead of a password. The private key stays on your computer, and the matching public key is stored on the server.
Which SSH key type should I use?
Use Ed25519 unless you must support very old systems. RSA with 3072 or 4096 bits is the common fallback for older software.
Where does the server store my public key?
In the ~/.ssh/authorized_keys file of the account that you log in to, one key per line.
Do I still need a passphrase on my key?
Yes. A passphrase protects the private key if someone copies the file. Use ssh-agent so that you only type it once per session.
What if I lose my private key?
Log in another way, remove the old public key line from authorized_keys, generate a new key pair and add the new public key.
Does key authentication work on a custom SSH port?
Yes. Add the port to your commands, for example ssh-copy-id -p 2222 user@server, as explained in our guide to SSH with a different port.
Conclusion
SSH key-based authentication gives you stronger security and a faster login than passwords. Generate an Ed25519 key with a passphrase, copy the public key with ssh-copy-id, test the login in a second terminal and only then disable password authentication. Add a firewall, a custom SSH port and regular updates to build a layered setup that is hard to attack.
ssh-keygen -t ed25519 → ssh-copy-id user@server → Test the key login → Add the key to ssh-agent and ~/.ssh/config → Set PasswordAuthentication no → sudo sshd -t → Restart SSH → Verify.Keep Learning with VMoreCloud
Find more step-by-step tutorials on Linux, networking, Windows Server, Azure and virtualization.
Sources & Further Reading
Technical note: option names, service names and defaults differ between OpenSSH versions and distributions. Test changes on a non-production server or keep console access available, and only change settings on systems that you are authorized to administer.