How to Use the ‘ssh-keygen’ and ‘ssh-copy-id’ Commands for Passwordless Logins

The Vulnerability of Passwords

If you manage a Linux server over the internet, you likely use SSH (Secure Shell) to log into it. By default, SSH asks for your username and your password.

This is a massive security vulnerability. Because SSH operates on a well-known port (Port 22), automated bots constantly scan the internet, finding servers and attempting millions of random passwords until they guess the correct one (a brute-force attack).

The solution is to disable password logins entirely and use Cryptographic SSH Keys. To implement this, you must use two terminal commands: ssh-keygen (to create the lock and key) and ssh-copy-id (to put the lock on the server).

1. Generating the Keys (ssh-keygen)

You must run this first command on your local computer (your laptop), not the remote server.

ssh-keygen -t ed25519 -C "admin_laptop_key"

Breaking down the syntax:

• -t ed25519: This tells the computer to use the ED25519 algorithm. It is modern, incredibly fast, and much more secure than the older RSA standard.
• -C "admin_laptop_key": This is an optional comment. It helps you identify this specific key later when you are looking at the server’s authorized list.

When you press Enter, the system will ask where to save the file (press Enter to accept the default ~/.ssh/ folder) and ask you to create a passphrase. (It is highly recommended to type a strong passphrase to encrypt the physical key on your hard drive).

You now have two files on your laptop:

1. id_ed25519: Your Private Key. You must never share this with anyone. It stays on your laptop forever.
2. id_ed25519.pub: Your Public Key (the “Lock”). This is what you will send to the remote server.

2. Transferring the Key (ssh-copy-id)

Now, you need to copy the .pub file (the lock) from your laptop to the remote server. Linux provides a brilliant utility specifically for this exact task.

ssh-copy-id [email protected]

The command will ask you for your standard password one final time. It will then log into the server, create the necessary ~/.ssh/authorized_keys folder structure with the correct security permissions, and insert your public key into the file.

3. The Passwordless Login

Once the copy is complete, attempt to log into your server normally.

ssh [email protected]

Instead of asking for the server’s password, the server will issue a mathematical challenge that only your private key can solve. Your local computer solves it instantly, and you are logged in. (If you set a passphrase in Step 1, your laptop will ask for it to unlock the local file, but this is happening entirely on your local machine).

4. The Final Step: Disabling Passwords

Now that your cryptographic keys are working, you must close the security hole. You must tell the server to reject all passwords.

On the remote server, open the SSH daemon configuration file using nano or vim:

sudo nano /etc/ssh/sshd_config

Scroll down until you find the line that says PasswordAuthentication yes. Change the yes to a no.

PasswordAuthentication no

Save the file, and restart the SSH service:

sudo systemctl restart sshd

Conclusion

By migrating from static passwords to cryptographic ED25519 keys, you mathematically eliminate the possibility of brute-force attacks. The combination of ssh-keygen and ssh-copy-id is the foundational workflow for securing Linux infrastructure across the globe.