How to Use the ssh-keygen Command to Create Secure SSH Keys in Ubuntu

When you connect to a remote Ubuntu server, the traditional method is to use a username and a password. However, relying on passwords for remote access is a significant security risk. Passwords can be intercepted, guessed, or compromised through brute-force automated attacks.

The industry standard for securing remote servers is to disable passwords entirely and use SSH Keys instead. SSH (Secure Shell) keys work like a digital lock and key system. You place a “public key” (the lock) on the server, and you keep a “private key” (the key) on your personal computer. When you attempt to connect, the server checks if you hold the correct private key. If you do, you are granted instant access.

You can generate this highly secure cryptographic pair directly from the Ubuntu terminal using the ssh-keygen command.

How to Generate an SSH Key Pair

You must perform this process on your local computer (the machine you are sitting in front of), not on the remote server.

1. Open your local terminal.
2. Type the following command. The -t ed25519 flag tells the system to use the modern, highly secure Ed25519 encryption algorithm, and the -C flag allows you to attach your email address as a label so you can easily identify the key later.

   ssh-keygen -t ed25519 -C "[email protected]"

3. Press Enter.
4. The system will prompt you for a file location: “Enter a file in which to save the key”. It is strongly recommended to simply press Enter to accept the default location (usually ~/.ssh/id_ed25519).
5. Next, the system will prompt you to “Enter passphrase (empty for no passphrase)”. A passphrase acts as a password for your private key. If someone steals your laptop, they cannot use your SSH key without this passphrase. Type a secure passphrase and press Enter.
6. Type the passphrase again to confirm.

The system will generate the keys and display a piece of “randomart” (an abstract block of text characters) confirming the process is complete.

Understanding Your New Keys

If you navigate to your hidden .ssh directory, you will now see two new files.

• id_ed25519: This is your private key. Treat this file like your physical house keys or your bank PIN. You must never share this file, upload it to the internet, or send it in an email. It must remain securely on your local computer.
• id_ed25519.pub: This is your public key (noted by the .pub extension). This is the “lock”. You can share this file freely. This is the file you must upload to any remote server or service (like GitHub) that you want to access.

How to Copy the Public Key to a Server

To use your new key, you must place the public key onto the remote server you wish to connect to. The easiest way to do this is using the ssh-copy-id command.

In your local terminal, type the following (replace “username” and “server_ip_address” with your actual remote server details):

ssh-copy-id username@server_ip_address

The system will ask for the user’s password one final time. Once entered, the public key is automatically copied to the correct location on the remote server. The next time you attempt to log in using ssh username@server_ip_address, you will be authenticated instantly via your secure key pair.