How to Use the Linux ssh-keygen Command for Passwordless Logins

The Password Fatigue Problem

If you manage multiple Linux servers, you likely use the ssh command dozens of times a day to log into them. Every single time you type ssh [email protected], the server stops you and demands your complex, 20-character password. Typing this out repeatedly is tedious, and if you use automated backup scripts, those scripts will break because they cannot manually type a password.

Furthermore, relying on passwords for server security is fundamentally flawed. Passwords can be guessed by automated bots conducting brute-force attacks across the internet.

The professional solution is to abandon passwords entirely and use SSH Keys. This system relies on complex cryptography. You use a tool called ssh-keygen to generate a mathematically linked pair of cryptographic keys: a “Public Key” and a “Private Key”. You put the public key on the server, and you keep the private key on your laptop. When you try to log in, the server challenges your laptop to a mathematical puzzle. If your laptop holds the matching private key, it solves the puzzle instantly and logs you in automatically, without ever asking for a password.

Generating the Key Pair

You must generate the keys on your local machine (e.g., your personal MacBook or Windows PC), not on the remote server.

1. Open your local terminal.
2. Type the following command and hit Enter:

ssh-keygen -t rsa -b 4096

Let’s break that down:

• ssh-keygen: The command to create the keys.
• -t rsa: Specifies the type of mathematical algorithm to use (RSA is the standard).
• -b 4096: Specifies the size/strength of the key in bits (4096 is highly secure).

Answering the Prompts

The terminal will ask you a series of questions. You can usually just hit Enter to accept the defaults for all of them.

1. “Enter file in which to save the key”: Hit Enter to save it in the default hidden .ssh directory.
2. “Enter passphrase (empty for no passphrase)”: If you enter a passphrase here, you will have to type that passphrase every time you use the key, defeating the purpose of a passwordless login. Hit Enter to leave it blank.
3. “Enter same passphrase again”: Hit Enter again.

The system will generate some random “fingerprint” art, confirming that your two keys have been created.

• Your Private Key (your secret identity) is saved as id_rsa. Never share this with anyone.
• Your Public Key (the lock) is saved as id_rsa.pub. This is what you will send to the server.

Copying the Key to the Server

Now you must transfer the Public Key to the remote Linux server so it knows to trust your laptop.

The easiest way to do this from a Mac or Linux laptop is using a built-in helper command called ssh-copy-id. Run this command locally, replacing the IP address with your server’s IP:

ssh-copy-id [email protected]

The server will ask you for your standard password one final time. Type it in. The tool will automatically log in, find the correct authorization file (~/.ssh/authorized_keys), paste your public key inside it, and set the correct permissions.

Testing the Passwordless Login

The setup is complete. To test it, attempt to log into the server normally from your local terminal:

ssh [email protected]

If you set it up correctly, the server will instantly recognize the cryptographic handshake from your private key. The password prompt will be bypassed entirely, and you will be dropped directly into the remote server’s command line.

Typing server passwords is for amateurs. By running the ssh-keygen command once, you can establish an unbreakable cryptographic trust between your laptop and your servers, enabling instant, highly secure access for both yourself and your automated scripts.