Accessing Servers with SSH Keys

SSH keys are the first thing I set up on any new server. Compared to passwords they're both more secure (nothing to brute-force) and more convenient (no prompt on every login). This is the full setup, from generating a key pair to logging in with it.

🔑 What SSH keys are

An SSH key pair has two halves:

• Private key — stays on your machine and never leaves it.
• Public key — copied to every server you want to access.

The server uses the public key to issue a challenge that only the holder of the private key can answer, so nothing secret ever travels over the wire.

🛠️ Step 1: Generate a key pair (if you don't have one)

BASH
copy
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

• -t rsa — use the RSA algorithm.
• -b 4096 — 4096-bit key size for strong security.
• -C "..." — a label so you can tell your keys apart later.

Press Enter to accept the default location (~/.ssh/id_rsa), then set a passphrase when prompted. The passphrase is optional, but it means a stolen private key file is still useless on its own — worth the small friction.

📁 Step 2: If you already have a key pair

Check ~/.ssh/ before generating anything — a second key pair when one already exists just creates confusion:

BASH
copy
ls ~/.ssh

If you see id_rsa (private key) and id_rsa.pub (public key), skip generation and go straight to installing the public key.

📤 Step 3: Add the public key to the server

1. Print your public key and copy the output:

   BASH
   copy
   cat ~/.ssh/id_rsa.pub
   

2. Log in to the server with whatever method you currently have (usually a password).

3. Append the key to authorized_keys:

   BASH
   copy
   echo "your_public_key_contents" >> ~/.ssh/authorized_keys
   

   Note the >> — a single > would overwrite the file and lock out every key already installed.

🔒 Step 4: Fix the permissions

SSH is strict about this: if these files are too open, it silently ignores them and falls back to password authentication.

BASH
copy
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/id_rsa

🔗 Step 5: Connect

BASH
copy
ssh -i ~/.ssh/id_rsa username@server_ip

• -i ~/.ssh/id_rsa — which private key to use.
• username / server_ip — the account and address of the server.

If the key is in the default location, you can drop the -i flag entirely — ssh looks there on its own. Adjust the command if your server uses a non-default port.

📌 Troubleshooting

• Connection refused — make sure the SSH service is running on the server.
• Timeout — check that the firewall allows the SSH port (22 by default).
• Still asked for a password — nine times out of ten it's the file permissions from Step 4.

🔚 Conclusion

Once key-based login works, the natural next step is disabling password authentication entirely in sshd_config — at that point, brute-force attempts against your server become pointless.

Happy coding 🚀