SSH Passwordless Login with ssh-keygen and ssh-copy-id (Step-by-Step)

Originally published on 2015-10-14; fully revised and updated.

Key-based SSH login lets you connect to remote Linux or Unix hosts without typing the account password on every login. This guide shows how to generate a key pair, install the public key with ssh-copy-id, verify access, use ssh-agent, and apply optional SSH hardening.

How passwordless SSH login works

SSH uses a public/private key pair. Your private key stays on your local machine, while the public key is added to the remote user’s ~/.ssh/authorized_keys. During login, the server validates cryptographic proof from your private key instead of prompting for the remote account password.

Workflow overview

flowchart TD
    A[Generate key pair] --> B[Install public key on server]
    B --> C[Test SSH login]
    C --> D{Prompt is only key passphrase}
    D -- yes --> E[Optional ssh-agent setup]
    D -- no --> F[Fix permissions and SSH settings]
    F --> B
    E --> G[Optional server hardening]

Step 1: Generate an SSH key pair

Run ssh-keygen on your local machine. If you do not pass options, OpenSSH will create a default key type. If your environment specifically requires RSA, generate it explicitly.

# Default key generation
ssh-keygen

# Explicit Ed25519 key
ssh-keygen -t ed25519 -C "your_name@your_laptop"

# Explicit RSA key (compatibility-focused environments)
ssh-keygen -t rsa -b 4096 -C "your_name@your_laptop"Code language: PHP (php)

Set a strong passphrase when prompted to protect your private key at rest.

Step 2: Copy the public key to the remote host

The easiest method is ssh-copy-id:

# Copy your default public key
ssh-copy-id user@hostname.example.com

# Copy a specific public key file
ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname.example.comCode language: PHP (php)

If ssh-copy-id is not available, you can append the key manually over SSH:

cat ~/.ssh/id_ed25519.pub | ssh user@123.45.56.78 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"Code language: JavaScript (javascript)

As noted in the original post, when keys are loaded into ssh-agent, ssh-copy-id can use agent-provided identities if you do not pass -i.

Step 3: Test login

ssh user@hostname.example.comCode language: CSS (css)

If configured correctly, you should not be prompted for the remote account password. You may still be asked for your key passphrase unless an agent is handling it.

Optional: Use ssh-agent for passphrase caching

# Start agent in current shell (if needed)
eval "$(ssh-agent -s)"

# Add private key to agent
ssh-add ~/.ssh/id_rsa

# Show loaded public keys
ssh-add -LCode language: PHP (php)

Command and method comparison

Optional server hardening (after successful key login)

Only harden SSH after confirming a non-root user can log in with keys. Older examples often show PermitRootLogin without-password; many modern OpenSSH setups use PermitRootLogin prohibit-password for the same intent.

# /etc/ssh/sshd_config
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yesCode language: PHP (php)

# Validate config, then reload service
sudo sshd -t
sudo systemctl reload sshd

# On some distributions, service name is ssh
sudo systemctl reload sshCode language: PHP (php)

Troubleshooting quick checks

• Verify remote permissions: ~/.ssh should typically be 700 and ~/.ssh/authorized_keys should typically be 600.
• Confirm you are connecting as the correct remote user.
• Use verbose output to diagnose authentication: ssh -v user@hostname.example.com.
• If multiple keys are present locally, test explicitly with ssh -i ~/.ssh/your_key user@hostname.example.com.

Original and related references

• How to SCP, SSH and rsync without prompting for password using OpenSSH
• ssh-copy-id man page (Ubuntu mirror)
• File copying and transfer between two machines

Best practices

• Use passphrase-protected keys and store private keys only on trusted endpoints.
• Prefer least-privilege users with sudo over direct root SSH access.
• Test key-based login in a separate session before disabling password authentication.
• Keep a rollback path (console or out-of-band access) before SSH hardening changes.

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.