Using SSH authentication keys

Mascote do LinuxPro enfiando a chave na fechadura do servidor, com o túnel SSH cifrado levando as chaves do notebook até o rack

Note (2026): The 2017 how-to generated RSA (ssh-keygen -t rsa) and disabled passwords with UsePAM no + /etc/init.d/ssh restart. Today the default is Ed25519; PAM stays enabled; the drop-in goes in sshd_config.d; only disable passwords after testing the key in a second session.

SSH passwords still fall to brute-force attacks. The key pair — public on the server, private on your machine, protected by a passphrase — is the 2026 login method. OpenSSH on Ubuntu 24.04/26.04 already generates Ed25519 if you call ssh-keygen without flags (since 9.5). The rest is permissions, ssh-copy-id and not locking yourself out.

Content hide

1 Generate the key on the client

2 Install the public key on the server

3 Disable passwords — without UsePAM no

4 Agent, config, hardware key

5 Wrap-up

Generate the key on the client

As your user, never as root:

ssh-keygen -t ed25519 -a 64 -C "$(whoami)@$(hostname)-2026"

Accept ~/.ssh/id_ed25519. Use a real passphrase — a private key without one is a login stored in a file. -a 64 increases KDF rounds. An old server that does not support Ed25519 (rare): ssh-keygen -t rsa -b 4096. DSA is dead in OpenSSH 7+.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

Install the public key on the server

ssh-copy-id creates ~/.ssh, fixes permissions, and appends the line to authorized_keys:

ssh-copy-id -i ~/.ssh/id_ed25519.pub usuario@servidor
# porta não padrão:
ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 2222 usuario@servidor

Without ssh-copy-id:

ssh usuario@servidor 'mkdir -p ~/.ssh && chmod 700 ~/.ssh'
cat ~/.ssh/id_ed25519.pub | ssh usuario@servidor 'cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

Test it before changing sshd:

ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes usuario@servidor

You must get in without the account password (the agent asks for the key's passphrase, if any). Leave this session open. Open another terminal for hardening.

Disable passwords — without UsePAM no

On Ubuntu, UsePAM no (the 2017 advice) breaks other PAM paths. Keep PAM. Use a drop-in, do not edit the entire sshd_config :

sudo tee /etc/ssh/sshd_config.d/99-keys-only.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password
EOF
sudo sshd -t && sudo systemctl reload ssh

On RHEL/Rocky the service is sshd: sudo systemctl reload sshd. Confirm in the session you left open, and in a new one:

ssh usuario@servidor

If the new one fails, the old session can still save you. Do not close the console until the key works twice.

Agent, config, hardware key

ssh-agent (or gnome-keyring) keeps the private key unlocked in the graphical session:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

A ~/.ssh/config avoids a flag:

Host lab
  HostName 192.0.2.10
  User nilton
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

YubiKey / FIDO2: ssh-keygen -t ed25519-sk (OpenSSH 8.2+). The private key never leaves the token. ssh-copy-id -i ~/.ssh/id_ed25519_sk.pub usuario@servidor.

Wrap-up

Ed25519, ssh-copy-id, test, and only then disable passwords. The 2017 diagram (client, session, keys) remains valid; the algorithm and the init.d do not. Man page: man ssh-keygen, man sshd_config.