How to generate an SSH key on Ubuntu
Run ssh-keygen on the computer you connect from, not on the Ubuntu server you are about to lock down. The server only stores the public half.
Ed25519 is the type to use on current Ubuntu. The comment labels this laptop so you can tell keys apart later.
- List what is already in ~/.ssh with ls -l ~/.ssh. If id_ed25519 is there and you still use it, do not overwrite it.
- Run ssh-keygen -t ed25519 -C "laptop-name". Press Enter to accept ~/.ssh/id_ed25519.
- Type a passphrase and type it again. An empty passphrase works, but a stolen laptop can then log in at once.
- Check the fingerprint ssh-keygen prints. You should have id_ed25519 and id_ed25519.pub in ~/.ssh.
If the other computer rejects Ed25519, make a second pair with ssh-keygen -t rsa -b 4096. Do not create a DSA key for a new login.
| Key type | Command | When to use it |
|---|---|---|
| Ed25519 | ssh-keygen -t ed25519 | Current Ubuntu and current OpenSSH |
| RSA 4096 | ssh-keygen -t rsa -b 4096 | An older host that refuses Ed25519 |
| Hardware key | ssh-keygen -t ed25519-sk | A security key is plugged in. A normal login does not need one. |
A hardware key is optional. A normal login to an Ubuntu VPS does not need one.
How to get the SSH public key on Ubuntu
The public key is the single line in ~/.ssh/id_ed25519.pub. Show it with cat ~/.ssh/id_ed25519.pub and copy that whole line.
The line starts with ssh-ed25519, then a long string, then your comment. That is the only text that belongs on a server.
- id_ed25519.pub is safe to copy onto a server.
- id_ed25519 is the private key. Leave it on this computer.
- If you chose another filename, cat that name with .pub on the end.
There is no extra get-key command. ssh-keygen already wrote the file. cat only displays it.
How to copy an SSH key to an Ubuntu server
Put the public line in ~/.ssh/authorized_keys for the user you log in as. The private key stays on the computer that generated it.
When that user can still log in with a password, run ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server from the client.
If ssh-copy-id is missing, log in once with the password, run mkdir -p ~/.ssh, and append the public line to ~/.ssh/authorized_keys. The local and remote usernames do not have to match. If they differ, connect as ssh remoteuser@server.
Test with ssh -i ~/.ssh/id_ed25519 user@server. It worked when a shell opens after the key passphrase and the account password is not asked. That session is SSH access.
Which file permissions an Ubuntu SSH key needs
OpenSSH ignores a key when the file or the home directory is open to other users. Set the modes, then try the login again.
- ~/.ssh is mode 700.
- The private key and authorized_keys are mode 600.
- The home directory is not writable by the group or by others: chmod go-w ~.
- The owner is the login user, not root. After a sudo copy, run chown -R user:user ~/.ssh.
A client warning that the private key is unprotected is fixed with chmod 600 on that file. If the server still asks for the account password, ssh -v shows which key was offered, and the server auth log names a permissions refusal.
An encrypted home directory hides authorized_keys until after you log in, so the server falls back to a password. The public key then has to live outside the home, which is a separate sshd setting.
Why an SSH key beats a password on Ubuntu
The private key is never sent to the server. The server stores only the public line, so guessing the account password is not what opens the session.
A passphrase locks the private file on the laptop. It is not the Ubuntu account password, and it is not sent to the server. The key changes how you prove who you are. The session is encrypted either way.
How to disable SSH password logins on Ubuntu
Turn password logins off only after a second window has already logged in with the key. Keep the first window open so you can undo a bad edit.
In /etc/ssh/sshd_config set PasswordAuthentication no and PubkeyAuthentication yes. Restart the daemon with sudo systemctl restart ssh. Do not close the working session until a new login succeeds with the key.
If the new login fails, put the old line back from the open session and restart ssh again. A restart applies the file. It does not create a key.
How to load an Ubuntu SSH key in PuTTY
PuTTY on Windows does not use the OpenSSH private file until PuTTYgen saves it as a .ppk. The Ubuntu server still wants the OpenSSH public line, not the .ppk.
- Copy id_ed25519 to the Windows PC by a private means. Do not email the private key.
- In PuTTYgen choose Conversions, then Import key, and open that file.
- Save the private key as a .ppk.
- In PuTTY open Connection, SSH, Auth, Credentials, and select the .ppk.
- Set the host to the Ubuntu server on port 22 and open the session.
It worked when PuTTY asks for the key passphrase and then shows a shell. The click-path for the session is in how to connect with PuTTY.
How to manage SSH keys across Ubuntu servers
One key pair per laptop is enough. Paste the same public line into authorized_keys on each Ubuntu server that laptop should reach.
If you need more than one key, name the file, for example ~/.ssh/id_ed25519_office, and pass -i when you connect. To retire a laptop, delete its public line on every server. Removing that line is what locks the key out.
Do not copy the private key onto the server. The server never needs it.
Frequently Asked Questions
How do I generate an SSH key on Ubuntu?
Run ssh-keygen -t ed25519 in a terminal on the computer you connect from. Press Enter to keep ~/.ssh/id_ed25519, set a passphrase, and confirm that id_ed25519.pub is beside the private file.
Should I use Ed25519 or RSA for an Ubuntu SSH key?
Use Ed25519 on current Ubuntu. Use ssh-keygen -t rsa -b 4096 only when the other host rejects Ed25519. Do not create a new DSA key.
How do I copy my SSH key to an Ubuntu server?
From the computer that holds the private key, run ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server. Or append the single .pub line to ~/.ssh/authorized_keys for that user on the server.
How do I get the SSH public key on Ubuntu?
Run cat ~/.ssh/id_ed25519.pub and copy the one line that starts with ssh-ed25519. Leave the file without .pub on that computer.
How do I use an Ubuntu SSH key in PuTTY?
Import the OpenSSH private key in PuTTYgen, save a .ppk, and choose that .ppk under Connection, SSH, Auth. The server still needs the OpenSSH public line, not the .ppk.
How do I turn off SSH password logins on Ubuntu?
After a key login already works in a second window, set PasswordAuthentication no in /etc/ssh/sshd_config and run sudo systemctl restart ssh. Keep the first session open until the new login succeeds.