How to Set Up SSH Keys and Disable Password Login

chmod 644 file

Logging in with SSH keys is safer than using a password: a key cannot be brute-forced, and you log in without typing a secret. Setting it up takes three steps: generate a key, copy it to the server, disable the password. Let’s go through each one.

How SSH keys work

A key is a pair of files: the private one (kept only by you) and the public one (placed on the server). When you connect, the server verifies that you hold the private key matching the public one — without the secret itself ever being sent.

Step 1. Generate a key pair

On your own computer (not on the server) run:

ssh-keygen -t ed25519 -C "my-laptop"

ed25519 is a modern, fast algorithm. If your client is old, use RSA:

ssh-keygen -t rsa -b 4096 -C "my-laptop"

The program asks for a path (~/.ssh/id_ed25519 by default) and a passphrase. The passphrase protects the key if the file is stolen, so we recommend setting one.

You end up with two files:

• ~/.ssh/id_ed25519 — the private key (never share it);
• ~/.ssh/id_ed25519.pub — the public key.

Step 2. Copy the key to the server

The easiest way is the ssh-copy-id utility:

ssh-copy-id deploy@YOUR_IP

It asks for the user password once and appends your public key to ~/.ssh/authorized_keys on the server.

If ssh-copy-id is not available (on Windows, for example), copy the key manually:

cat ~/.ssh/id_ed25519.pub | ssh deploy@YOUR_IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Step 3. Test the key login

Disconnect and connect again:

ssh deploy@YOUR_IP

If the login went through without a password prompt (or only asked for the key passphrase), it works. Do not disable the password until you are sure the key works.

Step 4. Disable password login

Open the SSH server configuration:

sudo nano /etc/ssh/sshd_config

Find these parameters and set them like this:

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password

Save the file and restart the service:

sudo systemctl restart ssh

On some systems the service is called sshd — then use sudo systemctl restart sshd.

File permissions

SSH checks permissions strictly. If key login does not work, check them:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Final checklist

Frequently asked questions

What if I lose the private key? It cannot be recovered. Connect through the KVM console in the server control panel, add a new public key to authorized_keys and remove the old one.

Can I use one key on several servers? Yes, the public key can be added to any number of servers. The private key stays single and stays with you.

How do I add a key from a second computer? Generate a pair on the second device and add its public key as a separate line in authorized_keys. One key per line.

Is it safe to disable the password completely? Yes, it is the recommended practice: it rules out password guessing. The main thing is to keep backup access through the KVM console in case you lose the key.

Summary

Key-based login removes the main weak spot — password guessing. Once you have set it up and turned off PasswordAuthentication, the server is noticeably safer and logging in is faster.

Want to practise on your own server? Take a Linux VPS, order VPS hosting, or hand the setup over in the Server administration section.