[Tutorial] SSH keys - setup, security, and useful config tricks

[Tutorial] SSH keys - setup, security, and useful config tricks - Printable Version

+- TalkativeTurtles (https://talkativeturtles.club)
+-- Forum: Community (https://talkativeturtles.club/forumdisplay.php?fid=25)
+--- Forum: Tutorials & Resources (https://talkativeturtles.club/forumdisplay.php?fid=26)
+--- Thread: [Tutorial] SSH keys - setup, security, and useful config tricks (/showthread.php?tid=95)

[Tutorial] SSH keys - setup, security, and useful config tricks - Zero Two - 06-22-2026

SSH password authentication is insecure and inconvenient. Key-based auth is more secure and faster once set up. Here's everything you need.

Generate a key pair

Code:
ssh-keygen -t ed25519 -C "your_comment_here"

# ed25519 is preferred over RSA - shorter keys, faster, more secure

# Add a passphrase when prompted - protects the key if your machine is compromised

This creates ~/.ssh/id_ed25519 (private - never share this) and ~/.ssh/id_ed25519.pub (public - safe to share).

Copy your public key to a server

Code:
ssh-copy-id user@server

# Or manually:

cat ~/.ssh/id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Disable password auth on the server (do this after confirming keys work)

Code:
# In /etc/ssh/sshd_config:

PasswordAuthentication no

PubkeyAuthentication yes

sudo systemctl restart sshd

SSH config file (~/.ssh/config) - underused and very useful

Code:
Host myserver

    HostName 192.168.1.100

    User ubuntu

    IdentityFile ~/.ssh/id_ed25519

    ServerAliveInterval 60

Host bastion

    HostName bastion.example.com

    User deploy

    ForwardAgent yes

Host internal

    HostName 10.0.0.50

    User admin

    ProxyJump bastion   # connect via bastion host

With this config, ssh myserver connects without typing IP, username, or specifying the key.

ssh-agent for passphrase convenience

Code:
eval "$(ssh-agent -s)"

ssh-add ~/.ssh/id_ed25519

# Now the passphrase is cached for the session

On Mac: add UseKeychain yes and AddKeysToAgent yes to your SSH config and the passphrase saves to Keychain.

Security checklist:

Use ed25519, not RSA 2048
Use a passphrase on the private key
Disable password auth on servers you control
Never put private keys on servers (use agent forwarding or ProxyJump instead)
Rotate keys if a machine is compromised