When you need to log into a remote Linux server via SSH, the default method is to type your username and a password. However, passwords can be guessed, brute-forced by automated bots, or accidentally typed while someone is watching your screen.
For true enterprise-grade security, Linux administrators abandon passwords entirely and use SSH Keys.
An SSH Key is essentially a cryptographic puzzle. You generate a matched pair of digital keys: a “Public Key” (which you place on the remote server like a padlock) and a “Private Key” (which stays hidden on your local laptop like the physical metal key). When you try to connect, the server checks if your Private Key fits the Public Key padlock. If the math matches, you are logged in instantly.
Step 1: Generate the SSH Key Pair
You must run this command on your local computer (the laptop you are using to connect), not on the remote server.
Open your local terminal and type the following command to run the key generation tool. We will use the ed25519 algorithm, which is the modern standard for speed and security (replacing the older, slower RSA algorithm).
ssh-keygen -t ed25519 -C "[email protected]"
(The -C flag just adds a comment—usually your email—so you can identify who owns the key later).
Step 2: Answer the Prompts
After you press Enter, the terminal will ask you a series of questions:
1. “Enter file in which to save the key:”
It will suggest a default location (usually /home/username/.ssh/id_ed25519). Do not type anything. Simply press Enter to accept the default location.
2. “Enter passphrase (empty for no passphrase):”
A passphrase adds a second layer of security. If a hacker steals your laptop and extracts your Private Key file, they still cannot use it without knowing this passphrase. Type a secure passphrase and press Enter. (If you want fully automated, password-less logins for scripts, you can leave it blank and press Enter, though this is less secure).
3. “Enter same passphrase again:”
Type it again to confirm.
The tool will generate a block of random ASCII art, confirming that your cryptographic keys have been created.
Step 3: Copy the Public Key to the Server
You now have two files hidden in your ~/.ssh/ folder:
– id_ed25519 (This is your Private Key. NEVER share this with anyone).
– id_ed25519.pub (This is your Public Key. This is what you put on the server).
To automatically push the Public Key onto the remote server, use the ssh-copy-id command. Type the following (replacing the username and IP address with your actual server details):
ssh-copy-id [email protected]
The terminal will ask for your standard server password one last time to authorize the transfer. Once accepted, the Public Key is locked into the server.
Step 4: Test the Connection
Now, try to log into the server normally:
Instead of asking for the server’s user password, your local terminal will ask for the passphrase you created in Step 2 to unlock your Private Key. Once unlocked, the cryptographic handshake happens instantly, and you are logged securely into the server without ever transmitting a password over the network.