How to Set Up SSH Key Authentication on Linux

SSH key authentication replaces password login with a public/private key pair — you keep the private key secret, and the server stores your public key to verify your identity.

ssh-keygen -t ed25519 -C "you@example.com"
ssh-copy-id user@server-ip

Steps

1. Run ssh-keygen -t ed25519 to generate a new key pair (id_ed25519 and id_ed25519.pub) — press enter to accept the default location, optionally set a passphrase
2. Run ssh-copy-id user@server-ip to append your public key to the server's ~/.ssh/authorized_keys file
3. Test with ssh user@server-ip — it should log you in without prompting for a password

How it works

The server only ever stores your public key, which can verify a signature but can't be used to impersonate you. Your private key never leaves your machine, so the server can confirm your identity without ever seeing a secret that could be stolen from it.

Things to watch for

• Once key-based login is confirmed working, disable password authentication in /etc/ssh/sshd_config (PasswordAuthentication no) to eliminate brute-force password attacks entirely
• Never share or upload your private key (the file without .pub) — only the .pub file is meant to be copied to servers

FAQ

What's the difference between RSA and ed25519 keys?

ed25519 is a newer elliptic-curve algorithm that produces shorter keys, is faster to generate/verify, and is considered at least as secure as a much longer RSA key — it's the recommended default on modern systems.