Setup SSH Key Authentication on Ubuntu

Create SSH keys keypair

The first step is to generate the key pair on the computer you will connect from, not on the server. The ssh-keygen command creates two files: a private key that never leaves your computer, and a public key that you send to the server. Once this is set up, you can connect without typing the account password each time.

The command below generates a new 4096-bit SSH key pair and adds your email address as a comment. The comment is only a label. It helps you tell your keys apart later if you have several.

1. Open a terminal on your local Ubuntu machine.
2. Run the command below, replacing the email address with your own.

ssh-keygen -t rsa -b 4096 -C "your_username@example.com"

After you run the command, ssh-keygen asks where to save the keys. It shows a default filename in brackets. In most cases the default is the right choice, so press ENTER to accept it.

Answer no unless you are sure you no longer need the old key. Overwriting it can lock you out of any server that still relies on it.

Enter file in which to save the key (/home/yourusername/.ssh/id_rsa):

Next, ssh-keygen asks for a passphrase. A passphrase encrypts the private key on your disk. If someone copies the key file, they still can't use it without the passphrase. The trade-off is that you type the passphrase before each login, unless you use an SSH agent to remember it.

You have two choices here:

• Type a strong passphrase, then type it again when asked to confirm. The terminal shows nothing as you type, so don't worry if the screen stays blank.
• Skip the passphrase for fully prompt-free logins. This is the choice the next step covers.

Enter passphrase (empty for no passphrase):

If you want to skip the passphrase, press ENTER at both prompts without typing anything. Keep in mind that anyone who gets a copy of your private key can then log in to your server. This is acceptable on a well-protected personal machine, but think twice for anything sensitive.

When the command finishes, your terminal output should look similar to the example below. It shows the file locations and a short "randomart" image, which is a visual fingerprint of the key.

Generating public/private rsa key pair.
Enter file in which to save the key (/home/richard/.ssh/id_rsa): 
Created directory '/home/richard/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/richard/.ssh/id_rsa
Your public key has been saved in /home/richard/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:F217Tplf9iVDvyTRBRfkeXEdQfCugtgC16BrpRqQYpE admin@example.com
The key's randomart image is:
+---[RSA 4096]----+
|             .=OO|
|  .        .  +.*|
| E     .  . o..=.|
|  o   . o  o oo+.|
|.+   o oS.. ..Bo=|
|o .   * o..  ++==|
|   . + o o . ...o|
|    +   .   .    |
|   .             |
+----[SHA256]-----+

Two new files now exist in the hidden .ssh folder inside your home directory:

• id_rsa is your private key. Never share it or copy it to the server.
• id_rsa.pub is your public key. This is the file you send to the server.

That's it! You have successfully created a key pair.

Copy the public key to target system

Now you need to tell the remote server to trust your key. The ssh-copy-id command does this by adding your public key to the account you specify. Once it's done, the server recognizes your computer and you no longer need the account password to log in. At this stage the server must still allow password logins, because you need one to authenticate this first time.

Run the command below from your local machine to copy your public key to the remote server.

ssh-copy-id username@server_ip_address

Before you run it, replace username and server_ip_address with the details of your own account on the remote server. These are the same details you would use for a normal SSH login: the username and the server's address.

Key-based authentication isn't set up yet, so the server asks for your SSH password. Type it and press ENTER. The terminal won't display the characters as you type.

Once you are authenticated, the public key ~/.ssh/id_rsa.pub is appended to the remote user's ~/.ssh/authorized_keys file, and the connection closes. Appending means any keys already in that file stay in place. After this, you should be able to open a new SSH connection to the server and get in without the account password. If you set a passphrase earlier, you will be asked for that instead.

richard@10.0.2.17's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'richard@10.0.2.17'"
and check to make sure that only the key(s) you wanted were added.

Configure SSH for passwordless login

Once key login works, you can switch off password logins completely. This stops anyone from guessing or brute-forcing your password, because the server accepts only trusted keys. You make the change in the server's sshd_config file.

If you turn off passwords and the key doesn't work, you will be locked out. You will also need an account with sudo rights on the server.

Log on to the remote server, then open the SSH configuration file by running the commands below.

1. Connect to the server over SSH.
2. Run the commands below to open the SSH configuration file in a text editor. You should see the contents of the file, with the cursor at the top.

sudo nano /etc/ssh/sshd_config

Scroll through the file and find the lines shown below. Some may be commented out with a # at the start of the line. If so, remove the # so the setting takes effect. Change each value to match the example.

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

Save the file and exit the editor. Your changes are not active yet, because the SSH server only reads this file when it starts.

Restart the SSH server on the remote host with the command below. Keep your current session open while you do this. Existing connections usually stay up during a restart, which gives you a way back in if something is wrong.

sudo systemctl restart ssh

After the restart, password login should be disabled. To check, open a new terminal and connect from a machine or account that has no key installed. The server should refuse the connection instead of asking for a password. Then connect from your own computer and confirm that your key still gets you in.

If you need to undo this, log in with your key, reopen the configuration file, change the values back, and restart the SSH server again.

As a quick reminder, the command ssh-copy-id user@remote_host sends your SSH public key to a remote server. This configures the remote server to recognize your key, allowing passwordless logins for future connections. Run it once for each server you want to access, and replace user and remote_host with your own details.

ssh username@server_ip_address

That should do it!

Conclusion:

You now have key-based SSH authentication working on Ubuntu. You generated a key pair, copied the public key to the server, and turned off password logins. Keep a backup of your private key somewhere safe, and never share it. If you hit errors or have something to add, use the comment form.