Use personal SSH keys

SSH keys separate user identities and avoid sharing an administrator password. Each person gets their own key pair, so you can later revoke one person’s access without touching anyone else’s.

Generate a key on your client

If you don’t already have one, create a key pair on your laptop, not on the server:

ssh-keygen -t ed25519 -C "flavio@laptop"

Accept the default location and set a passphrase. The private key stays on the laptop forever. Only the .pub half travels.

Install the public key

Copy a public key through an authorized existing login:

ssh-copy-id [email protected]
ssh [email protected]

ssh-copy-id appends your public key to ~/.ssh/authorized_keys on the server with the right permissions. The second command should now log you in without asking for the account password. If your key has a passphrase, you’ll type that instead, and an agent can remember it.

Verify the host key, once

The first connection shows a fingerprint prompt. Most people blindly type yes. Do it properly once: on the server’s console, print the real fingerprint and compare:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

If it matches what the client showed, you’ve verified you’re talking to your server and not something impersonating it. The client remembers the key after that, and will warn loudly if it ever changes.

Change access with a safety line

Whenever you touch SSH configuration, keep the current session open and test a second session before closing the first. The open session is your undo button.

The classic self-lockout goes like this: key login half works, you disable password authentication anyway, close the terminal, and now nothing gets in. So the rule is firm: do not disable password login until key login and recovery access are proven.

If key login fails with Permission denied (publickey), check permissions on the server: ~/.ssh must be 700 and authorized_keys must be 600, both owned by the user. SSH silently ignores the file otherwise.

And never share private keys. One person, one device, one key.