Key-Based Authentication Setup

Password authentication can be compromised through brute-force, keyloggers, or credential stuffing. Keys eliminate all of that.

Generate Key Pair

On your local machine — not the server:

# ED25519 recommended
ssh-keygen -t ed25519 -C "your_email@example.com" -f ~/.ssh/id_prod_server

# RSA fallback for older systems
ssh-keygen -t rsa -b 4096 -C "your_email@example.com" -f ~/.ssh/id_prod_server

ED25519 is faster, more secure, and uses shorter keys than RSA. I’ve switched all my infrastructure to it.

Deploy Public Key

ssh-copy-id -i ~/.ssh/id_prod_server.pub username@server_ip

# If ssh-copy-id isn't available
cat ~/.ssh/id_prod_server.pub | ssh username@server_ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Test Before Disabling Passwords

ssh -i ~/.ssh/id_prod_server username@server_ip

Confirm you can log in without a password before touching anything else.

Fix Permissions

SSH won’t use keys with incorrect permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/id_ed25519

Next Steps

Proceed to the SSH Daemon Hardening guide.