How to use SSH keys for authentication

Why the Keys?

Public key authentication works based on a set of keys specific for each user, called a public key-private key pair. The public key generated from the SSH client machine is copied to the authorized_keys file of the SSH server and that makes SSH server to consider the key as trusted. During login the server sends a challenge that only the holder of the matching private key can sign; the password is never transmitted.

How to setup SSH Key based Authentication

Create the key directory.

mkdir -p ~/.ssh

Secure .ssh directory for restricted access only for the SSH user.

chmod 700 ~/.ssh

Generate the key pairs.

ssh-keygen -t rsa

Follow the on screen messages to interactively create the keys, input a password (optional) to secure the private keys, this will be asked during SSH session if you set a password for private key access.

Copy the public key to the authorized_keys in server. 

You can either copy the txt from file ~/.ssh/id_rsa.pub and paste it to the ~/.ssh/authorized_keys file in server. Or you can use the ssh-copy-id utility in the below format for the key transfer.

ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

-i flag is used to input the identity file or public key.

Disable password authentication and enable public key authentication.

Log in to the server as root, open the file /etc/ssh/sshd_config with any text editor and make sure to set the directives as shown below.

PubkeyAuthentication yes
PasswordAuthentication no

If the key is for the root user, set PermitRootLogin prohibit-password so root can log in with a key but never with a password. For new keys, prefer ssh-keygen -t ed25519.

PermitRootLogin prohibit-password

Restart SSH Service in Server and try the SSH connection from client, use the -vv flag with SSH command if you encounter any connection issues.

ssh -vv root@yourhost.com

Tips

Directory ownership and permissions should be for that user chmod 600 ~/.ssh/id_rsa