Generate an SSH key on Ubuntu
To generate an SSH key on Ubuntu, run ssh-keygen -t ed25519 on the computer you connect from, accept ~/.ssh/id_ed25519 and set a passphrase. Copy only the .pub file to the server with ssh-copy-id, test a key login, then disable password logins in an sshd_config.d drop-in file.
For developers and VPS owners setting up key-based SSH logins to an Ubuntu server from Linux, macOS or Windows.
knowledge
- Read time
- 4 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
How to generate an SSH key on Ubuntu
Run ssh-keygen -t ed25519 on the computer you connect from, accept the default path ~/.ssh/id_ed25519, and set a passphrase. The server you log in to only ever receives the public half.
# check for an existing key first; do not overwrite one you still use
ls -l ~/.ssh
# create a new Ed25519 key pair
ssh-keygen -t ed25519 -C "office-laptop-2026"
# fallback for very old servers that reject Ed25519
ssh-keygen -t rsa -b 4096 -C "office-laptop-2026"| Type | Command | Use when |
|---|---|---|
| Ed25519 | ssh-keygen -t ed25519 | Default choice for current Ubuntu and OpenSSH |
| RSA 4096 | ssh-keygen -t rsa -b 4096 | Legacy systems or appliances that refuse Ed25519 |
| Ed25519-SK | ssh-keygen -t ed25519-sk | You use a FIDO2 hardware security key |
| DSA | none | Never; removed from modern OpenSSH |
The same ssh-keygen command works in Windows 10/11 PowerShell and on macOS, because both ship the OpenSSH client.
Which file is the public key and which is private?
id_ed25519.pub is the public key you copy to servers; id_ed25519 without an extension is the private key that must never leave your computer. Show the public key with cat ~/.ssh/id_ed25519.pub; it is one line beginning ssh-ed25519 and ending with your comment.
- Passphrase: encrypts the private key file on your disk. It is not your server password and is never sent to the server.
- Agent: type the passphrase once per session with
eval "$(ssh-agent -s)"thenssh-add ~/.ssh/id_ed25519. - Why it beats a password: the private key is never transmitted, so a stolen server database or a brute-force bot cannot recover it.
How the protocol works is explained in what SSH is.
How to copy the SSH key to an Ubuntu server
Use ssh-copy-id while password login still works; it appends your public key to ~/.ssh/authorized_keys for that user and sets sensible permissions.
# Linux / macOS
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@203.0.113.25
# Windows PowerShell (no ssh-copy-id)
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh deploy@203.0.113.25 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
# test: should ask for the key passphrase, not the account password
ssh -i ~/.ssh/id_ed25519 deploy@203.0.113.25Log in as a normal sudo user rather than root where possible; creating one is covered in adding a sudo user on Ubuntu. A new Ubuntu VPS may also let you paste the public key at order time, so the first login is key-based from the start.
File permissions OpenSSH insists on
OpenSSH silently ignores keys when ~/.ssh, authorized_keys or the home directory are writable by other users. If the server keeps asking for a password, fix these first.
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod go-w ~
chown -R "$USER":"$USER" ~/.ssh # if the files were created with sudoOn your own computer, the private key must be 600; a "permissions are too open" warning means it is not. To see why a key is refused, connect with ssh -v and read the server's /var/log/auth.log or journalctl -u ssh.
Turning off SSH password logins on Ubuntu 22.04 and 24.04
Disable passwords only after a second terminal has logged in with the key, and put the setting in a drop-in file, because Ubuntu cloud images ship /etc/ssh/sshd_config.d/50-cloud-init.conf with PasswordAuthentication yes, which overrides a later line in the main file. OpenSSH uses the first value it reads, and drop-in files are read before the rest of sshd_config.
# create a drop-in that sorts before 50-cloud-init.conf
sudo tee /etc/ssh/sshd_config.d/00-keys-only.conf >/dev/null <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password
EOF
sudo sshd -t # syntax check; no output means OK
sudo sshd -T | grep -E 'passwordauthentication|pubkeyauthentication'
sudo systemctl restart sshKeep the original session open until a fresh login with the key succeeds. If it fails, remove the drop-in from the open session and restart ssh again. Add brute-force protection with Fail2ban, and a second factor with SSH two-factor authentication.
Using the key with PuTTY and an SSH config file
PuTTY needs the private key converted to .ppk format with PuTTYgen, while the server keeps the normal OpenSSH public line; OpenSSH users can save typing with an entry in ~/.ssh/config.
- Move the private key to the Windows PC by a private method (not email), or generate the key on Windows in the first place.
- In PuTTYgen, choose Conversions → Import key, then Save private key as
.ppk. - In PuTTY, set Connection → SSH → Auth → Credentials to that
.ppk, enter the host and port 22, and open.
# ~/.ssh/config
Host webji-vps
HostName 203.0.113.25
User deploy
IdentityFile ~/.ssh/id_ed25519
# then simply
ssh webji-vpsOne key pair per device is enough; add its public line to each server that device should reach, and delete that line from every server when the device is retired. If a key login fails with "Connection refused" rather than "Permission denied", the problem is the SSH service or firewall; see SSH connection refused on a VPS.
Frequently asked questions
Should I use the same SSH key for GitHub and my servers?
You can, since only the public key is shared. Many developers prefer separate keys per purpose so revoking one does not affect the other. Name them, for example id_ed25519_github, and map each host in ~/.ssh/config.
I lost my private key. How do I get back into the server?
The private key cannot be recovered. Use another authorised key, or the provider's web console or rescue mode, to log in and add a new public key to authorized_keys. Then remove the old key's line so a found copy of it cannot be used.
Is an SSH key without a passphrase safe?
It works and suits automation, but anyone who copies the file can log in immediately. For personal keys, use a passphrase and ssh-agent. For deploy scripts, use a dedicated key limited to one user and, if possible, restricted commands.
Can I change the passphrase without making a new key?
Yes. Run ssh-keygen -p -f ~/.ssh/id_ed25519, enter the old passphrase and then the new one. The public key does not change, so nothing needs updating on your servers.
Checked 15 November 2026 against OpenSSH manual pages and Ubuntu Server documentation · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.