Beginner ~30 min

SSH Keys From Scratch: Your Machine to Your Servers

Create a key, put it on a server, name your servers in ~/.ssh/config, and connect with ssh prod instead of an IP address. Ends with a machine that logs in without passwords and a config you can copy to the next one.

0 / 19 done

Prerequisites

A terminal on your own machine: macOS Terminal, Linux shell, or Windows PowerShell
A server you can currently reach, with a password or an existing key
No prior SSH knowledge needed

Step 1 Command

Do not SSH into the server and generate a key there. That key lets the server reach other machines; it does nothing to get you into the server. The one exception is a deploy key, which is the last step of this guide.

Read this first: which machine am I on?

# Your own machine  ->  the key is generated here, and the private half stays here
# The server        ->  only the public half goes here

whoami && hostname

Almost every step in this guide runs on your own laptop or desktop. Only two touch the server, and each says so.

Step 2 Command

Windows, macOS or Linux?

# macOS / Linux : the terminal is ready, follow the steps as they are
# Windows       : open PowerShell and run the next step first
#
# Note for Windows: if you work inside WSL or Git Bash you are on
# Linux, so skip the PowerShell steps and follow the rest as they are.

The commands are identical on macOS and Linux. Windows differs in three places, and each has its own step: the agent is a service, there is no chmod, and the config file sits in your user profile.

Step 3 Snippet

Set Up SSH on Windows (PowerShell)

Windows only. Skip this on macOS and Linux.

Step 4 Snippet

If a key exists, do not generate over it. Anything that trusts it, servers and GitHub alike, would stop letting you in.

Check Whether You Already Have an SSH Key

On your own machine. A pair named id_ed25519 and id_ed25519.pub means you already have a key and can skip the next step.

Step 5 Snippet

Generate ed25519 SSH key

Key comment (usually email or device name) *

On your own machine. The same command works in PowerShell, Terminal and any Linux shell.

On your personal machine, yes. It encrypts the private key on disk, so a stolen laptop is not a stolen server, and the agent means you type it once per session. The exception is a key for automation on a server, which cannot have one because nothing is there to type it.

Step 6 Snippet

Fix ~/.ssh Permissions

macOS and Linux only. Windows has no chmod: a key inside your user profile is already private to you.

Step 7 Snippet

Load a Key into the SSH Agent

Key file name *

On your own machine. On Windows this works once the agent service is running from the earlier step.

Step 8 Snippet

Store an SSH Passphrase in the macOS Keychain

Key file name *

macOS only, and optional. It stops the passphrase prompt returning after every reboot.

Step 9 Command

Two ways to put the key on the server

# Easiest, if password login still works:      the next step
# If password login is off, or you paste in a panel:  the step after it

ssh-copy-id does it in one command when password login still works. The manual step after it is for servers where it does not, or for pasting into a provider panel.

Step 10 Snippet

Copy SSH Key to Remote Server

Remote User *

Server IP / Hostname *

Run this on your own machine, pointed at the server. It asks for your password one last time.

Step 11 Snippet

Only the .pub file is ever shared. The file without .pub is the private key and never leaves your machine.

Print Your Public Key to Paste It Somewhere

Key file name *

The alternative route: copy this line and paste it into GitHub, cPanel, or your provider dashboard. On Windows use: Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

Step 12 Snippet

Test an SSH Connection Without Opening a Shell

Username on the server *

Server address *

From your own machine. It should print OK and the hostname without asking for anything.

Step 13 Snippet

Set Up ~/.ssh/config for Several Servers

Short name you will type *

Server address *

Username on the server *

SSH port

Key file name *

macOS and Linux. Windows users: skip to the next step, which does the same thing in PowerShell.

Yes. Anything built on ssh reads the same file, so scp file.txt prod:/tmp/ and rsync -avz ./dist prod:/var/www/ work straight away.

Step 14 Snippet

Create ~/.ssh/config on Windows

Short name you will type *

Server address *

Username on the server *

SSH port

Key file name *

Windows only, and the equivalent of the previous step. The file lives at C:\Users\YourName\.ssh\config

Step 15 Snippet

Use a Different Key per Account or Host

Personal key file *

Work key file *

Optional, and the reason most people meet the config file at all: a work GitHub account and a personal one on the same machine.

Step 16 Snippet

SSH via Jump Host (Bastion)

Jump Host User *

Jump Host IP *

Target User *

Target Host IP *

For a server with no public address: reach it through a bastion in one command.

Yes, add ProxyJump bastion to that host block and plain ssh db1 routes through it every time.

Step 17 Snippet

Debug a Refused SSH Login (Verbose Mode)

Username on the server *

Server address *

Keep this one. When a login is refused, it names the cause instead of leaving you guessing.

Step 18 Snippet

Create a Deploy Key on a Server

Deploy user on the server *

Server name for the comment *

This one runs ON the server, and it is the only step in the guide that does. It is for automation, not for you.

Step 19 Snippet

Only after the previous steps succeed, and keep your current session open while you test a second one.

Disable Root SSH Login

On the server. The payoff: once key login is proven, turning off root login removes the attack surface brute force relies on.