How to Generate and Use ED25519 SSH Keys for Secure Server Authentication in Linux

Securing remote server access over Secure Shell (SSH) is a fundamental duty for system administrators, DevOps engineers, and self-hosters. However, relying on passwords for remote logins leaves servers exposed to automated brute-force attacks, credential stuffing, and dictionary botnets that hammer port 22 around the clock. While 2048-bit or 4096-bit RSA keys have long served as the industry standard, modern cryptography has adopted the ED25519 elliptic curve signature algorithm as the superior, highly secure, and lightweight replacement for public-key authentication.

Why ED25519 is Superior to Legacy RSA

Introduced to OpenSSH in 2014, ED25519 is based on the Edwards-curve Digital Signature Algorithm (EdDSA) over Curve25519. It provides compelling security and performance advantages:

• Compact Key Size: An ED25519 public key is only 68 characters long (256 bits), making it dramatically easier to copy, audit, and store compared to unwieldy 4096-bit RSA keys.
• Exceptional Verification Speed: Elliptic curve signatures verify much faster than RSA math, noticeably reducing handshake latencies across busy SSH connections.
• Side-Channel Attack Resistance: The mathematical implementation of ED25519 computes operations in constant time, rendering it immune to cache-timing attacks and side-channel cryptographic vulnerabilities.

Step 1: Generate an ED25519 SSH Key Pair on Your Local Machine

Open a terminal on your local Linux machine (or macOS terminal) and execute the ssh-keygen command with the -t flag:

ssh-keygen -t ed25519 -C "[email protected]"

The -C parameter appends an informative comment label (such as your email or workstation hostname) to the end of the public key, simplifying identity tracking across multi-user environments.

Responding to Prompts

1. File Destination: The prompt displays: Enter file in which to save the key (/home/user/.ssh/id_ed25519):. Press Enter to accept the default file path.
2. Passphrase Protection: Type a strong passphrase when prompted: Enter passphrase (empty for no passphrase):. While an empty passphrase allows automatic logins, providing a passphrase encrypts the private key on your local disk, preventing compromise if your laptop is ever stolen.
3. Confirm the passphrase by retyping it. The utility creates two distinct files in your ~/.ssh/ directory:
   • id_ed25519: Your private key (never share or disclose this file).
   • id_ed25519.pub: Your public key (this is uploaded to remote servers).

Step 2: Copy Your Public Key to the Remote Server

OpenSSH provides an automated utility called ssh-copy-id that safely copies your public key and configures appropriate filesystem permissions on the remote host in a single command:

ssh-copy-id -i ~/.ssh/id_ed25519.pub username@server_ip_address

Enter your remote account password one final time when prompted. The utility automatically creates the ~/.ssh/ directory on the remote server (if missing) and appends your public key to ~/.ssh/authorized_keys with correct 0600 permissions.

Alternative Manual Installation

If ssh-copy-id is unavailable on your client, copy the key manually using an SSH pipeline:

cat ~/.ssh/id_ed25519.pub | ssh username@server_ip_address "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Step 3: Test and Confirm Key-Based Authentication

Verify that your new elliptic curve key authenticates properly before modifying server security settings:

ssh username@server_ip_address

If you set a passphrase, your local system will prompt you for your key passphrase instead of the remote user password. Once authenticated, you land directly into your remote shell.

Step 4: Disable Insecure Password Authentication on the Server

Once key authentication is confirmed, completely eliminate brute-force attack vectors by disabling remote password logins:

1. On the remote server, open the SSH daemon configuration using sudo:

   sudo nano /etc/ssh/sshd_config

2. Locate the following directives and update their values:

   PasswordAuthentication no
   ChallengeResponseAuthentication no
   PubkeyAuthentication yes

3. Save the file (Ctrl + O, then Ctrl + X).
4. Test the configuration syntax to prevent accidental lockouts:

   sudo sshd -t

5. If no errors appear, reload the SSH service:

   sudo systemctl reload ssh

SSH Key Algorithm Comparison

Algorithm	Key Length	Security Level	Speed
ED25519 (Recommended)	256 bits	Extremely High (~128-bit symmetric strength)	Fastest
RSA 4096	4096 bits	High	Moderate
RSA 2048	2048 bits	Adequate (Legacy minimum)	Moderate
DSA	1024 bits	Deprecate / Insecure	Slow

Troubleshooting SSH Key Authentication Errors

If you encounter connection refusals or permission denials, verify these common administrative issues:

• Permission Denied (publickey): The remote SSH daemon strictly refuses keys if parent folder permissions are overly permissive. Ensure ~/.ssh is set to 700 (chmod 700 ~/.ssh) and ~/.ssh/authorized_keys is set to 600 (chmod 600 ~/.ssh/authorized_keys).
• Keep an Active Session Open: When editing /etc/ssh/sshd_config, never terminate your current terminal window until you have successfully initiated a separate, second SSH connection in another window to verify the new settings work.
• Using SSH Agent: To avoid typing your key passphrase on every single connection, load your key into the local authentication agent using ssh-add ~/.ssh/id_ed25519.

Migrating to ED25519 keys and disabling password-based SSH access establishes an unyielding security perimeter around your Linux servers while streamlining everyday administrative workflows.