How to Set up OpenSSH Key-Pair Authentication in Ubuntu 26.04

How key-pair authentication works

A key pair is two linked files. The private key stays on your Windows PC. The public key goes on the server. When you connect, the server checks that your PC holds the matching private key, so no password crosses the network.

The examples use USERNAME for your account on the server and 192.0.2.10 for its IP address. Replace both with your own values.

Check that the OpenSSH client is installed on 🪟 Windows 11

Windows 11 includes the OpenSSH client by default. Confirm it is present before you start.

1. Right-click the Start button and select Terminal.
2. Run this command to check the client version:

   💻Code

   Copy

   ssh -V

3. Look at the output. A version string means the client is installed.

If Windows says the command isn't recognized, open Settings › System › Optional features and select View features. Search for OpenSSH Client and install it.

Create the key pair on your Windows PC

This step generates the private and public key files in your user profile. You don't need administrator rights.

1. Open Terminal (PowerShell).
2. Run this command to create an Ed25519 key (a modern, compact key type):

   💻Code

   Copy

   ssh-keygen -t ed25519

3. At the Enter file in which to save the key prompt, press Enter to accept the default location, C:\Users\USERNAME\.ssh\id_ed25519.
4. Type a passphrase when prompted, then type it again to confirm. A passphrase protects the private key if someone copies the file. You can press Enter twice to skip it, but a passphrase is safer.
5. Look for a message saying your identification and public key were saved. You now have id_ed25519 (private) and id_ed25519.pub (public).

That file is your private key.

Copy the public key to the Ubuntu server

Windows has no ssh-copy-id tool, so you paste the key onto the server by hand. You log in with your password one last time to do it.

Copy the public key to the clipboard

This puts the public key on your clipboard, ready to paste. In PowerShell, run:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard

To read the key on screen instead, run the same command without | Set-Clipboard. The key is one line that starts with ssh-ed25519.

Add the key on the server

1. Connect to the server with your password:

   💻Code

   Copy

   ssh USERNAME@192.0.2.10

2. If SSH asks you to trust the host's fingerprint, type yes, then enter your password.
3. Create the .ssh folder and restrict it to your account:

   💻Code

   Copy

   mkdir -p ~/.ssh
   chmod 700 ~/.ssh

4. Open the key file in the nano editor:

   💻Code

   Copy

   nano ~/.ssh/authorized_keys

5. Paste the key from your clipboard by right-clicking in the terminal window. The key must stay on a single line.
6. Press Ctrl+O, press Enter to save, then press Ctrl+X to exit.
7. Restrict the file so only you can read and write it:

   🐧Bash / Shell

   Copy

   chmod 600 ~/.ssh/authorized_keys

8. Type exit to close the session.

SSH ignores the key file if its permissions are too open, so run both chmod commands.

Test the key login

1. In PowerShell on Windows, connect again:

   💻Code

   Copy

   ssh USERNAME@192.0.2.10

2. Enter your key passphrase if you set one. You reach the server prompt without being asked for the account password.

If the server still asks for the account password, run ssh -v USERNAME@192.0.2.10 and read the lines about offered keys. Permissions on the server are the most common cause.

Stop typing the passphrase every time with ssh-agent

ssh-agent is a Windows service that holds your unlocked private key in memory, so you enter the passphrase once instead of on every connection. Starting the service requires an elevated (administrator) window.

1. Right-click Start and select Terminal (Admin). Select Yes at the User Account Control prompt.
2. Set the service to start manually, then start it:

   ⬛PowerShell

   Copy

   Get-Service ssh-agent | Set-Service -StartupType Manual
   Start-Service ssh-agent

3. Close the admin window and open a normal Terminal window.
4. Add your key to the agent:

   💻Code

   Copy

   ssh-add $env:USERPROFILE\.ssh\id_ed25519

5. Enter the passphrase once. The agent remembers the key for later connections.

To start the agent automatically at every sign-in, use -StartupType Automatic instead of Manual in step 2.

Turn off password login on the server (optional)

Once key login works, disabling passwords stops anyone from guessing yours. This step requires sudo (administrator rights on the server).

If you lock yourself out, you need console access (a direct connection to the server that does not use SSH) to fix it.

1. Connect to the server using your key.
2. Create a configuration override file:

   🐧Bash / Shell

   Copy

   sudo nano /etc/ssh/sshd_config.d/99-keys-only.conf

3. Add this line:

   💻Code

   Copy

   PasswordAuthentication no

4. Press Ctrl+O, Enter, then Ctrl+X.
5. Check the file for errors. No output means the syntax is valid:

   🐧Bash / Shell

   Copy

   sudo sshd -t

6. Confirm the active value:

   🐧Bash / Shell

   Copy

   sudo sshd -T | grep -i passwordauthentication

   Expect passwordauthentication no. If it says yes, another file in the folder, such as one created by cloud-init (a tool that sets up a server the first time it starts), takes priority. SSH uses the first value it reads, so rename your file so it sorts earlier, for example 00-keys-only.conf.
7. Apply the change:

   🐧Bash / Shell

   Copy

   sudo systemctl restart ssh

8. Open a second PowerShell window and connect with ssh USERNAME@192.0.2.10. It logs in with your key.

If this didn't work

To undo the lockdown, delete the override file with sudo rm /etc/ssh/sshd_config.d/99-keys-only.conf and run sudo systemctl restart ssh to bring password login back. If key login keeps failing, check the server log with sudo journalctl -u ssh -e. It names the permission or ownership problem. Next, consider restricting SSH to specific users or setting up port forwarding.