How to Set Up SSH Keys on a Linux Server (and Turn Off Password Logins)
Within an hour of being reachable from the internet, a server starts getting password guesses — thousands of them a day. SSH keys fix that. Your computer holds a private key, the server holds the matching public key, and only a computer with the private key gets in. No password to guess, and nothing to type when you connect.
Quick reference
| Step | Command (run on your own computer) |
|---|---|
| Make a key | ssh-keygen -t ed25519 |
| Copy it to the server | ssh-copy-id john@192.168.1.50 |
| Test it | ssh john@192.168.1.50 — no password prompt |
| Turn off passwords | Edit /etc/ssh/sshd_config on the server |
1. Generate a key on your own computer
Open Terminal (Windows, Mac or Linux) and run:
ssh-keygen -t ed25519
Press Enter to accept the default file location. It then asks for a passphrase. Adding one means the key is useless if your laptop is stolen; leaving it empty means no typing at all. For a home server either is fine — a passphrase is the safer choice.
You now have two files in your .ssh folder: id_ed25519 (private — never share it) and id_ed25519.pub (public — this is what goes on the server).
2. Copy the public key to the server
Mac or Linux:
ssh-copy-id john@192.168.1.50
Type your password one last time.
Windows doesn't have ssh-copy-id, so use this instead (one line):
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh john@192.168.1.50 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
3. Test it
ssh john@192.168.1.50
If it logs you in without asking for the server password (it may ask for your key's passphrase instead), the key is working. Do not go further until this works — the next step locks the door.
4. Turn off password logins
On the server:
sudo nano /etc/ssh/sshd_config
Find these lines (use Ctrl + W to search) and set them like this, removing any # at the start:
PasswordAuthentication no
PubkeyAuthentication yes
Press Ctrl + O, Enter to save and Ctrl + X to exit. Then restart SSH:
sudo systemctl restart ssh
Keep your current session open and test from a second terminal window. If you can still get in, you're done. If not, you still have the first window to undo the change.
Using the key from another computer
Either copy the private key file to the other machine (securely — not by email) or, better, make a new key on that machine and copy its public key to the server too. The server can hold as many public keys as you like, one per line in ~/.ssh/authorized_keys.
Troubleshooting
Still asked for a password after copying the key. Permissions on the server are too open. Run:
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
"Permission denied (publickey)" after turning passwords off. The key isn't on the server for that user. If you've locked yourself out, log in at the server's own keyboard and set PasswordAuthentication yes again.
Windows says ssh-copy-id isn't recognised. Correct — use the type ... | ssh command above.
Wrapping up
One key on your computer, one line on the server, and password guessing becomes impossible. Make the key, copy it, test it, and only then switch passwords off. It's the single biggest security improvement you can make to a server, and it takes five minutes.
