> ## Content Index
> Fetch the complete content index at: https://techbookshelf.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to Set Up SSH Key Authentication on Linux: A Step-by-Step Guide
- URL: https://techbookshelf.com/set-up-ssh-key-authentication-linux/
- Published: 2026-10-05T19:00:00.000Z
- Updated: 2026-10-05T19:00:00.000Z
- Description: This guide explains how to set up SSH key authentication on Linux for secure, passwordless remote access using cryptographic key pairs.
- Author: Md Astafar Hossain
- Tags: Linux, SSH, Security, Authentication

This guide explains how to set up SSH key authentication on Linux, enabling secure and passwordless remote access. SSH key authentication uses a cryptographic key pair to replace traditional password login, enhancing security by [preventing brute force attacks](https://techbookshelf.com/p/4bbc9562-a3af-460c-af66-9a4f6c85e30c/) and credential theft.

The process begins with generating a public and private key pair, followed by installing the public key on the server. Configuring the SSH server to accept key-based authentication is essential to complete the setup. Additionally, the guide covers using SSH keys on Windows clients through tools like PuTTY or the built-in OpenSSH client, addressing cross-platform compatibility.

Practical troubleshooting tips and security cautions are included, such as managing file permissions and recognizing common misconfigurations that often cause authentication failures. This ensures a reliable and secure SSH key authentication environment.

## Before you start: Requirements and concepts

SSH key authentication uses cryptographic key pairs to establish secure, passwordless connections between a client and a server. Unlike password-based login, it relies on a private key kept secret by the user and a public key stored on the server. This method enhances security by preventing brute-force password attacks and eliminating the need to transmit passwords over the network.

Setting up SSH key authentication requires a Linux server with the SSH service active and a client machine running Linux or Windows with command line access. Users should be familiar with basic terminal commands.

SSH key pairs consist of a private key, which must be securely protected, and a public key, which is placed on the server to authorize access. Common key types include RSA and Ed25519, with Ed25519 generally preferred for better security and performance.

A typical key generation command looks like this:

1. Run `ssh-keygen -t ed25519 -C "user@example.com"`. The system prompts for a file location, defaulting to `~/.ssh/id_ed25519`, and an optional passphrase.
2. Upon success, the private key (`id_ed25519`) and public key (`id_ed25519.pub`) files are created in the specified directory.

Protecting the private key is critical, and once key authentication is confirmed working, disabling password authentication on the server improves overall security.

## How to set up SSH key authentication in Linux: Generating SSH keys

1. Open a terminal on the client machine where the SSH key pair will be created.
2. Run the command `ssh-keygen -t ed25519` to generate a new Ed25519 key pair. This algorithm is recommended for its strong security and efficiency compared to older types like RSA.
3. When prompted, specify a file path to save the keys or press Enter to accept the default location, typically `~/.ssh/id_ed25519` for the private key and `~/.ssh/id_ed25519.pub` for the public key.
4. Set a passphrase for the private key when asked. Using a passphrase enhances security but requires entering it when the key is used; leaving it empty allows passwordless use but is less secure.
5. Understand that the private key (`id_ed25519`) must remain secure and private, while the public key (`id_ed25519.pub`) is copied to the server to enable authentication.

After completion, verify the output showing the saved key locations and the generated key fingerprint. For example:

> Generating public/private ed25519 key pair.  
> Enter file in which to save the key (/home/user/.ssh/id\_ed25519):  
> Enter passphrase (empty for no passphrase):  
> Enter same passphrase again:  
> Your identification has been saved in /home/user/.ssh/id\_ed25519.  
> Your public key has been saved in /home/user/.ssh/id\_ed25519.pub.  
> The key fingerprint is:  
> SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx user@hostname

**Tip:** Using Ed25519 keys strikes a good balance of security and performance, and setting a passphrase adds protection in case the private key file is exposed.

## How to set up SSH keys Linux: Installing the public key on the server

To enable SSH key authentication, the public key must be installed on the Linux server. The simplest way is using `ssh-copy-id`, which automates copying the public key to the server's authorized keys file with proper permissions.

![How to set up SSH keys Linux: Installing the public key on the server – how to set up SSH key authentication on Linux](https://techbookshelf.com/content/images/2026/10/set-up-ssh-key-authentication-linux-2.webp)

1. Run `ssh-copy-id user@server`. A prompt for the user password appears. On success, the key is appended to `~/.ssh/authorized_keys` on the server.
2. Verify login with `ssh user@server` now uses the key instead of a password.

If `ssh-copy-id` is unavailable or manual control is preferred, copy the public key content:

1. On the local machine, display the public key with `cat ~/.ssh/id_ed25519.pub`.
2. On the server, create the `.ssh` directory if missing: `mkdir -p ~/.ssh`, then append the public key to `~/.ssh/authorized_keys` using a text editor or `echo 'public_key' >> ~/.ssh/authorized_keys`.
3. Set permissions: `chmod 700 ~/.ssh` and `chmod 600 ~/.ssh/authorized_keys`. Incorrect permissions cause authentication failures.
4. Confirm ownership of these files matches the user account.

**Security tips:** Regularly review `authorized_keys` for obsolete or unauthorized keys. Avoid setting overly permissive permissions to prevent unauthorized access.

## How to enable key based authentication SSH: Configuring the SSH server

1. Edit the SSH server configuration file `/etc/ssh/sshd_config` using a text editor such as `nano` or `vim`. Locate or add the line `PubkeyAuthentication yes` to ensure public key authentication is enabled. When successful, this setting allows the server to accept SSH key logins.
2. Optionally, for enhanced security, disable password authentication by setting `PasswordAuthentication no` in the same file. This prevents fallback to passwords but increases the risk of lockout if key authentication fails. Confirm that the line is uncommented.
3. Save the changes and exit the editor. Editing must be done with appropriate permissions, typically as root or via `sudo`.
4. Restart or reload the SSH daemon to apply the new settings. Use `sudo systemctl restart sshd` or `sudo service sshd restart` depending on the system. Successful restart means no error messages and the SSH service is active.
5. Take caution to maintain an active session or alternate access method (like console or another user with shell access) before disabling passwords to avoid remote lockout.

**Sample sshd\_config excerpt:**

| Setting                | Value |
| ---------------------- | ----- |
| PubkeyAuthentication   | yes   |
| PasswordAuthentication | no    |

**Tip:** Always test key authentication in a separate session before closing your current connection to prevent accidental lockout.

## Windows SSH key based authentication: Using SSH keys with Windows clients

Windows users can generate SSH keys using the built-in OpenSSH client or graphical tools like PuTTYgen. The OpenSSH client comes preinstalled on recent Windows versions and supports command-line key generation and usage. PuTTYgen provides a GUI alternative for creating keys and converting formats.

![Windows SSH key based authentication: Using SSH keys with Windows clients – how to set up SSH key authentication on Linux](https://techbookshelf.com/content/images/2026/10/set-up-ssh-key-authentication-linux-3.webp)

1. Open PowerShell or Command Prompt and run `ssh-keygen -t ed25519 -C "user@example.com"`. This generates a key pair, usually saved in `C:\Users\<username>\.ssh\`. Confirm creation by locating `id_ed25519` and `id_ed25519.pub`.
2. Alternatively, launch PuTTYgen from the Start menu, select **Ed25519** as the key type, and click **Generate**. Move the mouse to create randomness. Save the private key via **Save private key** (PPK format) and copy the public key text for server installation.
3. If using PuTTY for SSH connections, convert the private key to OpenSSH format if needed by selecting **Conversions > Export OpenSSH key** in PuTTYgen. Save this key for use with Windows OpenSSH or other clients.
4. Install the public key on the Linux server as described earlier, typically by appending it to `~/.ssh/authorized_keys`.
5. To connect using Windows Terminal or PowerShell, run `ssh -i C:\Users\<username>\.ssh\id_ed25519 user@server`. For PuTTY, load the server hostname, navigate to **Connection > SSH > Auth**, browse to the private key file, and open the session.

**Tip:** When using PuTTY, ensure the private key is in the correct PPK format; OpenSSH clients require PEM or OpenSSH format keys.

## Troubleshooting common SSH key authentication issues

Permission errors on the `~/.ssh` directory or `authorized_keys` file often prevent login, typically indicated by messages like "Permissions 0777 for ‘.ssh’ are too open." Ensuring `~/.ssh` is set to `700` and `authorized_keys` to `600` resolves this.

Incorrect or corrupted key formats can cause authentication failures. For example, "key\_load\_public: invalid format" suggests the public key file is malformed. Verifying the key format and regenerating keys if necessary is advised.

SSH agent forwarding issues may prompt repeated passphrase requests or failed authentications. Running `ssh-agent` and adding keys with `ssh-add` helps manage passphrases securely.

Server-side misconfigurations like disabled `PubkeyAuthentication` or incorrect `AuthorizedKeysFile` paths in `sshd_config` result in denied access. Checking the SSH server logs (often in `/var/log/auth.log` or `/var/log/secure`) aids diagnosis.

**Debugging tools:** Using `ssh -v` or multiple verbose flags (`-vvv`) provides detailed connection information, clarifying where authentication fails.

1. Run `ssh -v user@host` to observe verbose debug output; success shows "Authentication succeeded".
2. Check and correct permissions with `chmod 700 ~/.ssh` and `chmod 600 ~/.ssh/authorized_keys`.
3. Verify public key format with `ssh-keygen -l -f ~/.ssh/id_ed25519.pub` or regenerate keys if errors appear.
4. Start the SSH agent using `eval $(ssh-agent)` and add keys with `ssh-add ~/.ssh/id_ed25519`.
5. Inspect `sshd_config` for `PubkeyAuthentication yes` and correct `AuthorizedKeysFile` settings, then restart the SSH service.
6. Review server logs to pinpoint errors and adjust configurations accordingly.

**Tip:** Combining verbose SSH client output with server logs typically reveals the root cause of key authentication failures.

## Further reading

- [Types of Encryption: A Clear Guide to Algorithms and Applications](https://techbookshelf.com/p/27eac74a-95ab-46dc-8051-a208cbfbdea2/)
- [How to Secure a Squarespace Website: Step-by-Step Guide](https://techbookshelf.com/p/0d231e46-3909-4dc4-af3e-eabbb339d3a1/)

## Frequently asked questions

### How to setup ssh key authentication in linux?

Generating SSH keys on the client using `ssh-keygen` is the first step, followed by copying the public key to the server's `~/.ssh/authorized_keys` file. Ensure permissions on the `.ssh` directory and the `authorized_keys` file are restrictive (700 and 600 respectively). Finally, verify SSH server configuration allows key-based authentication.

### How to setup ssh key authentication?

SSH key authentication involves creating a public-private key pair and installing the public key on the target server. Clients use the private key to authenticate without a password. Configuring the SSH server to accept key authentication and disabling password authentication can enhance security.

### What is ssh key authentication?

SSH key authentication is a method to securely log into a server by using a cryptographic key pair instead of a password. The private key remains on the client, while the public key is placed on the server to verify the client's identity. This method reduces risks associated with password theft or brute force attacks.

### what is ssh key authentication

It is a secure way to access remote systems by using a matched pair of cryptographic keys—one private and one public. The public key is stored on the server, and the private key remains confidential on the client device. When connecting, the server validates the client's private key without transmitting it.

### how to setup ssh key authentication

Start by generating a key pair with `ssh-keygen` on the client machine. Transfer the public key to the server using `ssh-copy-id` or by manually appending it to `~/.ssh/authorized_keys`. Confirm that the server's SSH daemon configuration file (`/etc/ssh/sshd_config`) has `PubkeyAuthentication yes` enabled and reload the SSH service.

## What this guide does not cover

This guide does not cover advanced SSH configurations such as multi-factor authentication or integrating SSH keys with centralized identity management systems. These topics require specialized knowledge and additional tools beyond basic SSH key setup.

Users unfamiliar with command-line interfaces or system administration should proceed carefully to avoid accidental lockout or security misconfigurations. In such cases, consulting a qualified system administrator or using managed solutions may be advisable.

The most useful next step after setting up SSH key authentication is to establish a secure backup and recovery plan for private keys. Losing access to private keys can result in locked-out servers, so storing backups securely and using encrypted key storage options—such as ssh-agent or hardware security modules—helps maintain continuous access while preserving security.