SSH key authentication: how it works and how to set it up
Password login for SSH works, but it has two problems. Passwords can be guessed or leaked. And password logins are what automated bots hit thousands of times a day against any server with port 22 open to the internet.
Key authentication solves both. You generate a key pair: a private key that never leaves your machine and a public key that you put on the server. When you connect, the server encrypts a challenge using your public key. Your client decrypts it with the private key and sends back the answer. The server verifies it. Your actual private key never travels across the network.
Here is how to set it up.
Generate a key pair
On Linux, macOS, or Windows with OpenSSH:
ssh-keygen -t ed25519 -C "your@email.com"
It will ask where to save the key (the default ~/.ssh/id_ed25519 is fine) and optionally ask for a passphrase. A passphrase encrypts your private key file, so even if someone gets the file, they cannot use it without the passphrase. Worth setting if the key will be used for anything important.
If you need RSA for compatibility with older servers:
ssh-keygen -t rsa -b 4096 -C "your@email.com"
See our RSA vs Ed25519 comparison if you're unsure which to use. Ed25519 is the better choice for anything modern.
Copy the public key to the server
ssh-copy-id user@your-server
This appends your public key to ~/.ssh/authorized_keys on the server. If ssh-copy-id isn't available, you can do it manually:
cat ~/.ssh/id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
Then set the right permissions on the server:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
SSH is strict about file permissions. If authorized_keys is world-readable or the .ssh directory is group-writable, SSH will ignore the file entirely and fall back to password authentication, which can be confusing to debug.
Test the connection
ssh -i ~/.ssh/id_ed25519 user@your-server
If it connects without asking for a password, the key is working.
Disable password authentication (optional but recommended)
Once key authentication is working, you can turn off password logins entirely. Open /etc/ssh/sshd_config on the server:
sudo nano /etc/ssh/sshd_config
Find and set:
PasswordAuthentication no
PubkeyAuthentication yes
Then reload the daemon:
sudo systemctl reload sshd
Do not do this before confirming your key login works. If you lock out password auth before the key is set up correctly, you will lose access.
Using keys with SSHDock
SSHDock supports private key authentication from the browser. In the connection form, paste the contents of your private key file (the one without .pub). SSHDock stores it in your browser's local storage and uses it to authenticate. It never leaves your device.
If your key has a passphrase, you will be prompted for it when you connect.