SSH Key Authentication Tutorial: Generate, Configure, and Use Keys Securely

Overview

SSH keys replace passwords with public-key cryptography. They are faster, immune to brute-force attacks, and required by most cloud providers. This tutorial covers generating keys, deploying them to a server, and managing multiple keys with a config file.

How SSH Key Authentication Works

1. You generate a key pair: a private key (kept secret) and a public key (shared freely).
2. You place the public key on the server in ~/.ssh/authorized_keys.
3. When you connect, the server sends a challenge that only the private key can answer.
4. The client signs the challenge; the server verifies the signature against the stored public key.

The private key never leaves your machine.

Step 1: Generate a Key Pair

ssh-keygen -t ed25519 -C "you@example.com"

ed25519 is the modern recommended algorithm. If you need compatibility with very old servers, use rsa with a 4096-bit key:

ssh-keygen -t rsa -b 4096 -C "you@example.com"

You will be prompted for a file location and a passphrase. Always set a passphrase.

Step 2: Copy the Public Key to the Server

ssh-copy-id user@server.example.com

If ssh-copy-id is unavailable, manually append:

cat ~/.ssh/id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Step 3: Disable Password Authentication

On the server, edit /etc/ssh/sshd_config:

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password

Restart SSH:

sudo systemctl restart sshd

Keep an existing session open while testing so you are not locked out.

Managing Multiple Keys with ~/.ssh/config

Host github.com
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_github

Host production
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/id_ed25519_prod
    IdentitiesOnly yes

Now ssh production connects with the correct key.

Using ssh-agent

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh-add -l

The agent caches the decrypted key so you only enter the passphrase once per session.

File Permissions Reference

SSH refuses to use keys with looser permissions, so fix these first if authentication fails.

Troubleshooting