MirrorNest
← All guides

SSH key-based authentication + disable password login

Switch a Linux server from password SSH login to key-based authentication only -- removes the single most common attack surface (brute-forced passwords) on any internet-facing server.

Target: Ubuntu / Debian / any systemd-based LinuxSecuritySSHOfficial homepage ↗Official docs ↗
This guide is synthesized from SSH key-based authentication + disable password login's own official documentation, linked above — always cross-check exact package/version names there before running these commands on a production server, since distro and project versions move over time.

  1. 1Generate a key pair on your OWN machine (not the server)

    ssh-keygen -t ed25519 -C "your-name@your-computer"

  2. 2Copy the public key to the server

    ssh-copy-id user@your-server-ip

    If ssh-copy-id isn't available, manually append the contents of ~/.ssh/id_ed25519.pub to ~/.ssh/authorized_keys on the server.

  3. 3Confirm key-based login works BEFORE disabling passwords

    ssh user@your-server-ip

    Do not proceed until this logs you in with no password prompt -- disabling password auth before confirming this can lock you out entirely.

  4. 4Disable password authentication

    sudo sed -i 's/#\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config
    sudo systemctl restart sshd

  5. 5Keep your current session open while testing a fresh one

    Open a SECOND terminal and confirm a brand-new SSH connection still works before closing your original session -- your safety net if something's misconfigured.