Set Up SSH Keys on Ubuntu 24.04 and 22.04 (ed25519)

SSH keys log you in without a password and are far harder to break than one. Create a modern ed25519 key, copy it to your server, test it, then switch password logins off. Works the same on Ubuntu 24.04, 22.04 and 20.04.

1. Create a key pair on your computer

Run this on your own computer, not the server. Press Enter to accept the default file and set a passphrase when asked. ed25519 is the modern default; use rsa -b 4096 only for very old systems.

ssh-keygen -t ed25519 -C "you@example.com"

2. Copy the public key to the server

ssh-copy-id adds your public key to ~/.ssh/authorized_keys on the server. On Windows without ssh-copy-id, use the second command in PowerShell.

ssh-copy-id user@server_ip
# Windows PowerShell:
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@server_ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

3. Test the key login

Open a NEW terminal and log in. If it asks for your key passphrase (not the server password), it worked. Keep your current session open until you are sure.

ssh user@server_ip

4. Turn off password logins

Only after step 3 works. Create a small config file so updates do not overwrite it, then restart SSH. On Ubuntu 24.04 the service is named ssh.

echo 'PasswordAuthentication no' | sudo tee /etc/ssh/sshd_config.d/99-no-passwords.conf
sudo sshd -t && sudo systemctl restart ssh

5. Check it took effect

This should print passwordauthentication no.

sudo sshd -T | grep -i passwordauthentication

FAQ

I get Permission denied (publickey). What now?

Check that ~/.ssh is 700 and ~/.ssh/authorized_keys is 600 on the server, that you are using the right user name, and run ssh -v user@server_ip to see which key is offered.

Should I set a passphrase on my key?

Yes. If your laptop is stolen, the passphrase protects the key. ssh-agent or your OS keychain remembers it so you only type it once per session.