Home→Archive↴

Use SSH keys on Linux for Passwordless Logins to Servers

Last edited on 2025-04-07 • Tagged under  #ssh   #linux   #server   #encrypt   #network   #shell 

Disable password logins on the SERVER in favour of using SSH keys for authentication. Create the necessary SSH keys on a Linux CLIENT that will be used to secure access to remote devices.

1. Start Here

On BOTH the Linux CLIENT and the SERVER

Create the .ssh directory and authorized_keys file in $HOME:

$ mkdir ~/.ssh && touch ~/.ssh/authorized_keys
$ chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

2. Create Public and Private Keys

On the Linux CLIENT

Create the SSH public/private key pair protected with a passphrase using ssh-keygen:

$ ssh-keygen -t ed25519 -C "$(whoami)@$(hostname -s)-$(date +%Y-%m-%d)"

Add the newly-created SSH private key to the current session by running ssh-add:

$ ssh-add ~/.ssh/id_ed25519
Enter passphrase for /home/<username>/.ssh/id_ed25519:

Any SSH logins launched during the session will now access this key stored in memory.

3. Share Public Key

On the Linux CLIENT

Upload the public key using ssh-copy-id to the SERVER and append to the SERVER authorized_keys file:

$ ssh-copy-id -i ~/.ssh/id_ed25519.pub [remote_ip_address]

EXAMPLE
SERVER has a [remote_ip_address] of 178.123.1.456:

$ ssh-copy-id -i ~/.ssh/id_ed25519.pub 178.123.1.456

Verify key-based authentication is configured correctly by successfully logging in using ssh without a password:

$ ssh -o PasswordAuthentication=no 178.123.1.456

4. Disable Password Logins

On the SERVER

After verifying the SERVER can be accessed remotely using SSH keys, open sshd_config for editing:

# vi /etc/ssh/sshd_config

Disable password authentication with these modifications:

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no

As an additional security measure, change the port (by default port 22) that SSH listens for connections. Changing this to a dynamic or private port between 49152 through 65535 will frustrate automated attacks.

EXAMPLE
Modify the SERVER listening port from #Port 22 to Port 52222:

Port 52222

Save changes and exit.

Restart SSH:

  • On Linux servers using systemd:
# systemctl restart ssh
  • On FreeBSD and NetBSD servers:
# service sshd restart
  • On OpenBSD servers:
# rcctl restart sshd

On the Linux CLIENT

While remaining logged into SERVER, open another terminal and verify the changes by attempting a new login using password authentication (which should fail):

$ ssh -p 52222 -o PreferredAuthentications=password -o PubkeyAuthentication=no 178.123.1.456
<username>@178.123.1.456: Permission denied (publickey).

Verify key-based authentication continues to work as before:

$ ssh -p 52222 178.123.1.456

Device is now secured to accept only SSH key authentication for logins.

5. Create An Alias

On the Linux CLIENT

Create an alias for the remote SERVER in the user ssh_config:

$ vi ~/.ssh/config

Add an alias for SERVER named myserver:

Host myserver
  HostName 178.123.1.456
  Port 52222

Save changes and exit.

Now a login to SERVER is simply:

$ ssh myserver

Good stuff!

You can like, share, or comment on this post on the Fediverse 💬

Thanks for reading! Read other posts?

» Next: Use SSH keys on NetBSD for Passwordless Logins to Servers

« Previous: Getting Started with OpenBSD