Set up an SSH key

Login with a key pair instead of a password.

An SSH key consists of a private part that stays on your own computer and a public part that goes on the server.

Why a key makes sense

• Safer than a password: A key is far too long for anyone to guess or try out. Automated programs constantly try passwords from dictionaries and random combinations.
• No password over the network: When logging in, your computer proves with the private key that it is authorised. The secret itself is never transmitted.
• More convenient: After setup, no password is needed, and scripts or backups can log in automatically.
• Prerequisite for more protection: Only with a key can password login be safely switched off later (see Secure SSH).

1. Create a key on your own computer

ssh-keygen -t ed25519 -C "name@device"

The key is stored at ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public). A passphrase is recommended.

2. Copy the public key to the server

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@IP-ADDRESS

This also works on Windows (PowerShell). If ssh-copy-id is missing, paste the contents of id_ed25519.pub into /root/.ssh/authorized_keys.

3. Test the login

ssh -i ~/.ssh/id_ed25519 root@IP-ADDRESS

Alternative: RSA key

ed25519 is the recommended choice. However, some programs, older devices and panels cannot use ed25519. In that case use an RSA key with at least 3072 bits, preferably 4096:

ssh-keygen -t rsa -b 4096 -C "name@device"

The procedure is the same as above: the public part ~/.ssh/id_rsa.pub goes to the server with ssh-copy-id -i ~/.ssh/id_rsa.pub root@IP-ADDRESS, and the login is tested with ssh -i ~/.ssh/id_rsa root@IP-ADDRESS. Never share the private key id_rsa.

Continue with Create a user with sudo and Secure SSH.