How to set up SSH keys on Linux

SSH keys replace passwords with cryptography. An ed25519 key is small, fast, and secure — prefer it over RSA.

1. Generate a key pair

ssh-keygen -t ed25519 -C "you@laptop"

Press Enter to accept the default location (~/.ssh/id_ed25519). A passphrase is optional but recommended: it encrypts the private key at rest.

2. Copy the public key to your server

ssh-copy-id user@server.example.com

This appends the public key to ~/.ssh/authorized_keys on the server and sets correct permissions. No ssh-copy-id? Do it by hand:

cat ~/.ssh/id_ed25519.pub | ssh user@server 'mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

3. Test before locking anything

Open a new terminal and confirm you can log in without a password:

ssh user@server.example.com

Keep your existing session open while testing.

4. Disable password authentication (optional, recommended)

On the server, edit /etc/ssh/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes

Then reload:

sudo systemctl reload sshd

Permissions that matter

Path	Mode
~/.ssh	700
~/.ssh/authorized_keys	600
private key (id_ed25519)	600

Wrong permissions are the most common cause of refused keys.

Troubleshooting

Run the client with verbose output:

ssh -v user@server.example.com

Look for Offering public key: followed by Server accepted key. If the offer never appears, the key was not loaded; check ssh-add -l and add it with ssh-add.