How to Generate SSH Key Pairs Using the Linux ssh-keygen Command

Secure Shell (SSH) is the standard protocol for remotely accessing and managing Linux servers. While you can log into a server using a traditional username and password, this method is highly vulnerable to brute-force automated dictionary attacks. The industry standard for securing Linux infrastructure is to disable password logins entirely and use SSH Key Pairs instead. An SSH key pair consists of two cryptographically linked files: a public key (which you place on the server) and a private key (which you keep securely on your local computer). To generate these secure cryptographic files from the command line, you must use the ssh-keygen command.

Generating a Modern Ed25519 Key Pair

Historically, RSA (Rivest-Shamir-Adleman) was the default cryptographic algorithm for SSH keys. However, modern security standards strongly recommend using the Ed25519 algorithm instead. Ed25519 keys are significantly shorter (making them faster to process and easier to copy/paste) while providing much stronger mathematical resistance against cracking attempts.

1. Open the terminal application on your local computer (not the remote server).
2. Type the command, specifying the algorithm type with the -t flag: ssh-keygen -t ed25519 -C "[email protected]" (The -C flag is optional; it adds a comment, usually your email address, to the end of the public key file to help you identify it later).
3. Press Enter.

The Interactive Generation Process

Once you press Enter, the ssh-keygen command will guide you through a short interactive prompt.

1. Choosing the file location:
The prompt will ask: Enter file in which to save the key (/home/user/.ssh/id_ed25519):
If you do not already have an SSH key on your machine, simply press Enter to accept the default location. Saving it in the default ~/.ssh/ directory ensures that your SSH client will find the key automatically without requiring complex configuration files.

2. Setting a passphrase:
The prompt will ask: Enter passphrase (empty for no passphrase):
A passphrase acts as a second layer of defense. If a hacker physically steals your laptop and manages to extract your private key file, they still cannot use it to access your servers unless they also know the passphrase you type here. Type a strong password and press Enter. (The characters will not appear on the screen as you type for security reasons). You will be asked to type it a second time to confirm.

If you are generating a key for an automated background script (like a CI/CD pipeline) that cannot type a password, you must leave this blank and press Enter twice.

Understanding the Output Files

When the process finishes, the terminal will display a randomart image (a visual representation of your key’s fingerprint). The command has successfully created two files in your ~/.ssh/ directory:

• id_ed25519: This is your PRIVATE KEY. It is the digital equivalent of your house key. You must never share this file with anyone, never email it, and never upload it to a public GitHub repository. If someone obtains this file, they can impersonate you.
• id_ed25519.pub: This is your PUBLIC KEY. It is the digital equivalent of a padlock. This is the file you will copy and paste into the ~/.ssh/authorized_keys file on your remote Linux servers.

When you attempt to connect to the server, the server will check if the private key on your laptop mathematically unlocks the public padlock stored on its hard drive. If it does, you are granted instant access.