Home→Archive↴

Configure SSH for Passwordless Logins to NetBSD Servers

Last edited on 2026-08-23 • Tagged under  #ssh   #netbsd   #bsd   #encrypt   #network   #selfhosting 

Create SSH keys on a NetBSD CLIENT that will be used to secure access to remote devices. Disable password logins on a NetBSD SERVER in favour of using SSH keys for authentication.

• Start Here
• Create Public and Private Keys
• Share Public Key
• Disable Password Logins
• Create an Alias
• Keychain

Start Here

On BOTH the CLIENT and the SERVER

Create the .ssh directory and authorized_keys file in $HOME:

mkdir ~/.ssh && touch ~/.ssh/authorized_keys
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

Create Public and Private Keys

On the CLIENT

Create the SSH public/private key pair protected with a passphrase using ssh-keygen(1):

ssh-keygen -t ed25519 -C "$(whoami)@$(hostname -s)-$(date +%Y-%m-%d)" 

Start ssh-agent(1):

eval "$(ssh-agent -s)"

Add the newly-created SSH private key to the current session using ssh-add(1):

ssh-add ~/.ssh/id_ed25519

Any SSH logins launched during the session will now access this key stored in memory.

Share Public Key

On the CLIENT

Upload the public key using ssh-copy-id(1) to the SERVER and append to its authorized_keys file:

ssh-copy-id -i ~/.ssh/id_ed25519.pub [remote_ip_address]

Example: SERVER has a [remote_ip_address] of 178.123.1.45:

ssh-copy-id -i ~/.ssh/id_ed25519.pub 178.123.1.45

Verify key-based authentication is configured correctly by successfully logging in using ssh(1) without a password:

ssh -o PasswordAuthentication=no 178.123.1.45

Disable Password Logins

On the SERVER

After verifying the SERVER can be accessed remotely using SSH keys, open sshd_config for editing:

vi /etc/ssh/sshd_config

Disable password authentication (and root logins) with these modifications:

PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no

Save changes and exit.

Reload SSH:

service sshd reload

On the CLIENT

While remaining logged into SERVER, open another terminal and verify the changes by attempting a new login using password authentication (which should fail):

$ ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no 178.123.1.45
<username>@178.123.1.45: Permission denied (publickey).

Verify key-based authentication continues to work as before:

ssh 178.123.1.45

Device is now secured to accept only SSH key authentication for logins.

Create An Alias

On the CLIENT

Create an alias for the SERVER in the user’s ssh_config:

vi ~/.ssh/config

Add an alias for SERVER named myserver:

Host myserver
  HostName 178.123.1.45

Save changes and exit.

Now login to SERVER is simply:

ssh myserver

Keychain

On the CLIENT

For CLIENT devices that are not running desktop environments with their own built-in ssh key management tools, I like to install keychain to manage my keys:

pkgin install keychain

When logging in for the first time after boot, it prompts me for the passphrase to unlock my key, then will maintain a single ssh-agent process across multiple login sessions.

Flush all cached keys from memory:

keychain --clear                  

Configure the user’s SHELL to launch keychain at login and unlock the user’s private SSH key.

Example: If using sh as SHELL, open .shrc:

vi ~/.shrc

Add:

case "$-" in *i*)
	# interactive mode settings go here
	if command -v keychain 2>&1 >/dev/null; then
		eval $(keychain --eval id_ed25519)
	fi
	;;
esac

Save changes and exit.

You can like, share, or comment on this post on the Fediverse 💬

» Next: Customize the Login on NetBSD

« Previous: NetBSD 11.0 Installation with Disk Encryption