Beginner ~25 min

SSH Keys From Scratch: Your Machine to Your Servers

Create a key, put it on a server, name your servers in ~/.ssh/config, and connect with ssh prod instead of an IP address. Ends with a machine that logs in without passwords and a config you can copy to the next one.

0 / 13 done

Prerequisites

A terminal on your own machine (macOS, Linux, or Windows with WSL or Git Bash)
A server you can currently reach, with a password or an existing key
No prior SSH knowledge needed

Step 1 Snippet

If a key exists, do not generate over it. Anything that trusts it, servers and GitHub alike, would stop letting you in.

Check Whether You Already Have an SSH Key

A pair named id_ed25519 and id_ed25519.pub means you already have a key and can skip the next step.

Step 2 Snippet

Generate ed25519 SSH key

Key comment (usually email or device name) *

Yes. It encrypts the private key on disk, so a stolen laptop is not a stolen server. The agent, two steps down, means you only type it once per session.

Step 3 Snippet

Fix ~/.ssh Permissions

Run this even on a fresh key. It is the fix for most "it keeps asking for my password" reports.

Step 4 Snippet

Load a Key into the SSH Agent

Key file name *

ssh-add -l should now list your key fingerprint. An empty list means the agent is not running.

Step 5 Command

Two ways to put the key on the server

# الأسهل، إن كان لديك دخول بكلمة مرور:  الخطوة التالية
# وإن كان الدخول بكلمة المرور معطلاً، أو تلصق عبر لوحة تحكم:  الخطوة التي تليها

ssh-copy-id does it in one command when password login still works. The manual step after it is for servers where it does not, or for pasting into a provider panel.

Step 6 Snippet

Copy SSH Key to Remote Server

Remote User *

Server IP / Hostname *

It asks for your password one last time. After this, that password is no longer part of your workflow.

Step 7 Snippet

Only the .pub file is ever shared. The file without .pub is the private key and never leaves your machine.

Print Your Public Key to Paste It Somewhere

Key file name *

The alternative route: copy this line and paste it into GitHub, cPanel, or your provider dashboard.

Step 8 Snippet

Test an SSH Connection Without Opening a Shell

Username on the server *

Server address *

It should print OK and the hostname without asking for anything. If it asks for a password, go back to the permissions step.

Step 9 Snippet

Set Up ~/.ssh/config for Several Servers

Short name you will type *

Server address *

Username on the server *

SSH port

Key file name *

This is the step that changes your day: ssh prod now replaces the address, the user and the port.

Yes. Anything built on ssh reads the same file, so scp file.txt prod:/tmp/ and rsync -avz ./dist prod:/var/www/ work straight away.

Step 10 Snippet

Use a Different Key per Account or Host

Personal key file *

Work key file *

Optional, and the reason most people meet ~/.ssh/config in the first place: a work GitHub account and a personal one on the same laptop.

Step 11 Snippet

SSH via Jump Host (Bastion)

Jump Host User *

Jump Host IP *

Target User *

Target Host IP *

For a server with no public address: reach it through a bastion in one command.

Yes, add ProxyJump bastion to that host block and plain ssh db1 routes through it every time.

Step 12 Snippet

Debug a Refused SSH Login (Verbose Mode)

Username on the server *

Server address *

Keep this one. When a login is refused, it names the cause instead of leaving you guessing.

Step 13 Snippet

Only after the previous steps succeed, and keep your current session open while you test a second one.

Disable Root SSH Login

The payoff: once key login is proven, turning off passwords and root login removes the attack surface brute force relies on.