Home→Archive↴

Configure SSH for Passwordless Logins to FreeBSD Servers

Last edited on 2026-08-14 • Tagged under  #ssh   #freebsd   #bsd   #linux   #encrypt   #network   #selfhosting 

Create SSH keys on a BSD or Linux CLIENT that will be used to secure access to remote devices. Disable password logins on a FreeBSD SERVER in favour of using SSH keys for authentication.

Start Here

On BOTH the CLIENT and the SERVER

Create the .ssh directory and authorized_keys file in $HOME:

mkdir ~/.ssh && touch ~/.ssh/authorized_keys
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

Create Public and Private Keys

On the CLIENT

Create the SSH public/private key pair (example: ed25519) protected with a passphrase:

ssh-keygen -t ed25519 -C "$(whoami)@$(hostname -s)-$(date +%Y-%m-%d)"

Start ssh-agent:

eval "$(ssh-agent -s)"

Add the newly-created SSH private key to the current session:

ssh-add ~/.ssh/id_ed25519

Any SSH logins launched during the session will now access this key stored in memory.

Share Public Key

On the CLIENT

Upload the public key to the SERVER and append to the authorized_keys file:

ssh-copy-id -i ~/.ssh/id_ed25519.pub [remote_ip_address]

Example: SERVER has a [remote_ip_address] of 178.123.1.45:

ssh-copy-id -i ~/.ssh/id_ed25519.pub 178.123.1.45

Verify key-based authentication is configured correctly by successfully logging in using ssh without a password:

ssh -o PasswordAuthentication=no 178.123.1.45

Disable Password Logins

On the SERVER

After verifying the SERVER can be accessed remotely using SSH keys, open sshd_config for editing:

doas vi /etc/ssh/sshd_config

Disable password authentication (and root login) with these modifications:

PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no

Save changes and exit.

Reload SSH:

doas service sshd reload

On the CLIENT

While remaining logged into SERVER, open another terminal and verify the changes by attempting a new login using password authentication (which should fail):

$ ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no 178.123.1.45
<username>@178.123.1.45: Permission denied (publickey).

Verify key-based authentication continues to work as before:

ssh 178.123.1.45

Device is now secured to accept only SSH key authentication for logins.

Create an Alias

On the CLIENT

Create an alias for the SERVER in the user’s ssh_config:

vi ~/.ssh/config

Add an alias for SERVER named myserver:

Host myserver
  HostName 178.123.1.45

Save changes and exit.

Now login to SERVER is simply:

ssh myserver

Keychain

On the CLIENT

For CLIENT devices that are not running desktop environments with their own built-in ssh key management tools, I like to install keychain. Most Linux distros and BSDs package it for easy installation.

When logging in for the first time after boot, it prompts me for the passphrase to unlock my key, then will maintain a single ssh-agent process across multiple login sessions.

Flush all cached keys from memory:

keychain --clear

Configure the user’s SHELL to launch keychain at login and unlock the user’s private SSH key.

Example: My shell-of-choice is fish and I modify config.fish:

vi ~/.config/fish/config.fish

Add:

if status is-interactive
    if command -v keychain > /dev/null
        eval (env SHELL=fish keychain --eval --quiet id_ed25519)
    end
end

Save changes and exit.

You can like, share, or comment on this post on the Fediverse 💬

Thanks for reading! Read other posts?

» Next: Set Up a Basic Firewall on FreeBSD

« Previous: FreeBSD: After the First Boot