Skip to content

Setting up SSH key login on Ubuntu

Sample how-to

This page is a sample, written so you can see how a how-to looks on thisbit.net. The method itself is sound. Replace the page when you add a real write-up.

These steps set up SSH public-key login from your own computer to an Ubuntu 22.04 or 24.04 server you already control, then turn off password login. Do this only on machines you administer. Keep a second session open until you have proven the key works, so you do not lock yourself out.

What you'll need

  • An Ubuntu 22.04 or 24.04 server with SSH already reachable
  • A local user account on that server that can use sudo
  • A terminal on the computer you will log in from
  • Out-of-band access if you can get it (cloud serial console, or another person at the machine)

1. Create a key on your computer

On your local machine, generate an Ed25519 key if you do not already have one you want to use for this server:

ssh-keygen -t ed25519 -C "thisbit-laptop" -f ~/.ssh/id_ed25519

Press Enter to accept the file path if you used the default, and set a passphrase. A key with a passphrase is still convenient if you use ssh-agent, and it stays useful if the file is ever copied.

If ~/.ssh/id_ed25519 already exists, do not overwrite it. Either reuse that key or choose a different filename and pass it with -i later.

2. Copy the public key to the server

The straightforward method:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server.example

If ssh-copy-id is not available, log in once with your current method and append the public key yourself:

mkdir -p ~/.ssh
chmod 700 ~/.ssh
cat >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Paste the contents of your local id_ed25519.pub file into that cat command, then press Ctrl-D. The public key is one line; the private key never leaves your computer.

3. Test the key before you change anything else

Open a new terminal and log in with the key, leaving the original session untouched:

ssh -i ~/.ssh/id_ed25519 user@server.example

If the login succeeds without asking for the account password, the key is working. If you set a passphrase, you may be asked for that passphrase, which is expected.

4. Tighten the SSH service

On Ubuntu, prefer a drop-in file so a later package update is less likely to wipe your changes:

sudo nano /etc/ssh/sshd_config.d/99-key-login.conf

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

Check the config, then reload the service. On Ubuntu the service name is ssh, not sshd:

sudo sshd -t && sudo systemctl reload ssh

If a cloud-init file in /etc/ssh/sshd_config.d/ still sets PasswordAuthentication yes, either change that file or make sure your drop-in is the one that applies. After a reload, confirm from the still-open session:

sudo sshd -T | grep -E 'passwordauthentication|kbdinteractiveauthentication|permitrootlogin|pubkeyauthentication'

You want passwordauthentication no, kbdinteractiveauthentication no, permitrootlogin no, and pubkeyauthentication yes.

5. Prove you can still get in

From a new terminal, log in with the key one more time. Only when that works should you close the original session. Then, from a third attempt, confirm that a password login is refused.

If something goes wrong

  • Permission denied (publickey) usually means the server does not have your public key, or ~/.ssh is not 700 and authorized_keys is not 600, and owned by your user.
  • You can also be denied if you used a non-default key file and did not pass -i, or if IdentitiesOnly yes is set in your local ~/.ssh/config without an IdentityFile.
  • If you are already locked out, use the hosting panel's serial console or another local login, then put PasswordAuthentication yes back, reload ssh, and fix the key path before tightening it again.

One key per role is easier to retire

A separate key for this server (or this class of server) is easier to replace than a single key used everywhere. If you use a non-default path, add a short Host block in ~/.ssh/config so you do not have to remember -i each time.