How to Setup an SSH Key in Linux

If you are managing a remote Linux server (like a DigitalOcean Droplet or an AWS EC2 instance), logging in with a standard username and password is a massive security risk. Automated botnets constantly scan the internet, attempting to brute-force weak passwords on open SSH ports.

To secure your server, you must disable password authentication entirely and switch to Cryptographic SSH Keys. An SSH key is essentially a massively complex, unguessable digital password consisting of two parts: a Public Key (which acts like a padlock on your server) and a Private Key (which acts like the physical key stored safely on your laptop). You can only log into the server if you possess the Private Key.

Step 1: Generate the SSH Key Pair

You must generate the keys on your local, personal computer (e.g., your MacBook or your Windows PC running WSL), NOT on the remote server.

1. Open the terminal on your local computer.
2. Type the following command to generate a modern, highly secure ED25519 cryptographic key pair (which is much faster and more secure than older RSA keys):

ssh-keygen -t ed25519 -C "[email protected]"

3. Press Enter.
4. The terminal will ask you where to save the file. (e.g., “Enter file in which to save the key”). Simply press Enter to accept the default, hidden .ssh folder location.
5. The terminal will then ask you to enter a passphrase. This is highly recommended. If someone steals your laptop, the passphrase acts as a secondary layer of encryption protecting your private key. Type a strong passphrase and press Enter. (The characters will be invisible as you type).
6. Type the passphrase again to confirm.

You have now successfully generated two files in your ~/.ssh/ directory: id_ed25519 (your top-secret Private Key) and id_ed25519.pub (your Public Key).

Step 2: Copy the Public Key to the Server

Now that you have the key pair, you must take the Public half (the padlock) and physically copy it over to the remote Linux server.

1. In your local terminal, type the ssh-copy-id command, replacing “username” and “server_ip_address” with your actual server details:

ssh-copy-id username@server_ip_address

2. Press Enter.
3. The terminal will attempt to connect to the server and will ask for your old, standard password one last time. Type the password and press Enter.

The utility will securely transmit the contents of your id_ed25519.pub file and inject it into the server’s ~/.ssh/authorized_keys configuration file.

(Note for Windows Users: If the `ssh-copy-id` command does not exist on your machine, you must print the public key to your screen using cat ~/.ssh/id_ed25519.pub, highlight the massive string of text, log into your server normally, and manually paste it into the ~/.ssh/authorized_keys file).

Step 3: Test the Connection

Before you turn off password authentication, you must verify that the SSH key actually works. You do not want to accidentally lock yourself out of your own server.

1. In your local terminal, attempt to log in normally:

ssh username@server_ip_address

2. Press Enter.

Instead of asking for your server password, the terminal should immediately grant you access (or, if you set a passphrase in Step 1, it will ask for the passphrase to unlock your local key). If you reach the server prompt, the cryptographic handshake was successful.

Step 4: Disable Password Authentication (Crucial)

Your server is currently accepting both SSH Keys and standard passwords. To make the server impenetrable, you must command the SSH daemon to permanently reject all password attempts.

1. While logged into the remote server, open the SSH configuration file with nano:

sudo nano /etc/ssh/sshd_config

2. Use your arrow keys to scroll down through the file until you find a line that says PasswordAuthentication yes. (If it has a `#` at the beginning of the line, delete the `#` to uncomment it).
3. Change the word yes to no.

PasswordAuthentication no

4. Press Ctrl + O to save, press Enter to confirm, and press Ctrl + X to exit the text editor.
5. You must restart the SSH service to apply the new rules. Type this command:

sudo systemctl restart sshd

Your server is now locked down. It will instantly drop any connection attempt that does not present your specific Private Key.