How to Generate and Use SSH Keys for Secure Passwordless Login in Linux

Secure Shell (SSH) is the gold standard for remotely managing Linux servers and communicating across networks. However, constantly typing long, complex passwords every time you need to log into a remote machine is tedious and creates a workflow bottleneck. Furthermore, relying solely on passwords leaves your server vulnerable to brute-force attacks.

The solution is to generate and use SSH keys. By configuring SSH keys for passwordless login, you can drastically improve both your efficiency and your system security.

What Are SSH Keys?

SSH keys rely on a cryptographic system known as public-key cryptography. When you generate an SSH key, you create a matched pair of text files:

• A Public Key: This is completely safe to share. You place this key on any remote server you wish to access.
• A Private Key: This must be kept entirely secret and secure on your local machine. It acts as your unique digital signature.

When you attempt to connect to the remote server, the server checks if you possess the private key that mathematically matches its public key. If the math checks out, you are instantly granted access.

How to Generate an SSH Key Pair

To get started, you need to create a new key pair on your local computer.

1. Open your terminal.
2. Enter the following command to generate a highly secure Ed25519 key (the modern standard for SSH):
   ssh-keygen -t ed25519 -C "[email protected]"
3. You will be prompted to choose a file path to save the key. Press Enter to accept the default location (usually ~/.ssh/id_ed25519).
4. You will then be asked to enter an optional passphrase. While a passphrase adds an extra layer of encryption if someone steals your physical computer, leaving it blank allows for true passwordless automation. Press Enter to proceed.

Your keys have now been generated and stored in your hidden .ssh directory.

How to Copy the Public Key to Your Remote Server

Next, you must transfer your public key to the remote machine you wish to control. The easiest way to do this is by using the ssh-copy-id command.

1. In your terminal, run the following command, replacing username with your remote username and remote_host with the server’s IP address:
   ssh-copy-id username@remote_host
2. You may see a warning stating that the authenticity of the host cannot be established. Type yes and press Enter to connect.
3. You will be prompted for your remote user’s password. This should be the last time you ever have to type it. Enter the password and press Enter.

The utility will securely connect to the server and append your public key to the server’s ~/.ssh/authorized_keys file.

How to Test Your Passwordless Login

You can now verify that everything is working correctly.

1. Attempt to connect to the remote server using the standard SSH command:
   ssh username@remote_host
2. If your keys are configured correctly, you will be instantly dropped into the remote shell without being prompted for a password.

How to Disable Password Authentication (Optional but Recommended)

Now that you can log in using your cryptographic keys, you can significantly enhance your server’s security by disabling traditional password logins entirely.

1. While logged into the remote server, open the SSH daemon configuration file using a text editor with root privileges:
   sudo nano /etc/ssh/sshd_config
2. Scroll through the file and locate the line that says PasswordAuthentication yes.
3. Change the yes to a no.
4. Save the file (Ctrl + O, Enter) and exit (Ctrl + X).
5. Restart the SSH service to apply the changes:
   sudo systemctl restart ssh

Your server is now locked down and will only accept connections from devices that hold your secret private key.