{"id":440,"date":"2026-10-14T10:11:33","date_gmt":"2026-10-14T10:11:33","guid":{"rendered":"http:\/\/www.scmgalaxy.com\/tutorials\/2015\/10\/14\/steps-to-perform-ssh-login-without-password-using-ssh-keygen-and-ssh-copy-id\/"},"modified":"2026-10-14T10:11:33","modified_gmt":"2026-10-14T10:11:33","slug":"steps-to-perform-ssh-login-without-password-using-ssh-keygen-and-ssh-copy-id","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/steps-to-perform-ssh-login-without-password-using-ssh-keygen-and-ssh-copy-id\/","title":{"rendered":"SSH Passwordless Login with ssh-keygen and ssh-copy-id (Step-by-Step)"},"content":{"rendered":"\n

Originally published on 2015-10-14; fully revised and updated.<\/em><\/p>\n\n\n

\n
\"SSH<\/figure>\n<\/div>\n\n\n

Key-based SSH login lets you connect to remote Linux or Unix hosts without typing the account password on every login. This guide shows how to generate a key pair, install the public key with ssh-copy-id<\/code>, verify access, use ssh-agent<\/code>, and apply optional SSH hardening.<\/p>\n\n\n\n

How passwordless SSH login works<\/h2>\n\n\n\n

SSH uses a public\/private key pair<\/strong>. Your private key stays on your local machine, while the public key is added to the remote user\u2019s ~\/.ssh\/authorized_keys<\/code>. During login, the server validates cryptographic proof from your private key instead of prompting for the remote account password.<\/p>\n\n\n\n

Workflow overview<\/h2>\n\n\n\n
\nflowchart TD\n    A[Generate key pair] --> B[Install public key on server]\n    B --> C[Test SSH login]\n    C --> D{Prompt is only key passphrase}\n    D -- yes --> E[Optional ssh-agent setup]\n    D -- no --> F[Fix permissions and SSH settings]\n    F --> B\n    E --> G[Optional server hardening]\n<\/pre>\n\n\n\n
Step 1: Generate an SSH key pair<\/h2>\n\n\n\n
Run ssh-keygen<\/code> on your local machine. If you do not pass options, OpenSSH will create a default key type. If your environment specifically requires RSA, generate it explicitly.<\/p>\n\n\n
# Default key generation<\/span>\nssh-keygen\n\n# Explicit Ed25519 key<\/span>\nssh-keygen -t ed25519 -C \"your_name@your_laptop\"<\/span>\n\n# Explicit RSA key (compatibility-focused environments)<\/span>\nssh-keygen -t rsa -b 4096<\/span> -C \"your_name@your_laptop\"<\/span><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Set a strong passphrase<\/strong> when prompted to protect your private key at rest.<\/p>\n\n\n\n
Step 2: Copy the public key to the remote host<\/h2>\n\n\n\n
The easiest method is ssh-copy-id<\/code>:<\/p>\n\n\n
# Copy your default public key<\/span>\nssh-copy-id user@hostname.example.com\n\n# Copy a specific public key file<\/span>\nssh-copy-id -i ~\/.ssh\/id_rsa.pub user@hostname.example.com<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
If ssh-copy-id<\/code> is not available, you can append the key manually over SSH:<\/p>\n\n\n
cat ~\/.ssh\/i<\/span>d_ed25519.pub | ssh user@123.45<\/span>.56<\/span>.78<\/span> \"mkdir -p ~\/.ssh && chmod 700 ~\/.ssh && cat >> ~\/.ssh\/authorized_keys && chmod 600 ~\/.ssh\/authorized_keys\"<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
As noted in the original post, when keys are loaded into ssh-agent<\/code>, ssh-copy-id<\/code> can use agent-provided identities if you do not pass -i<\/code>.<\/p>\n\n\n\n
Step 3: Test login<\/h2>\n\n\n
ssh<\/span> user<\/span>@hostname<\/span>.example.com<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
If configured correctly, you should not be prompted for the remote account password. You may still be asked for your key passphrase unless an agent is handling it.<\/p>\n\n\n\n
Optional: Use ssh-agent for passphrase caching<\/h2>\n\n\n
# Start agent in current shell (if needed)<\/span>\neval<\/span> \"$(ssh-agent -s)\"<\/span>\n\n# Add private key to agent<\/span>\nssh-add ~\/.ssh\/id_rsa\n\n# Show loaded public keys<\/span>\nssh-add -L<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Command and method comparison<\/h2>\n\n\n\n
Method<\/th>Best for<\/th>Example<\/th>Notes<\/th><\/tr><\/thead>
ssh-copy-id user@host<\/code><\/td>Standard setup<\/td>Install default local public key<\/td>Fast and usually least error-prone<\/td><\/tr>
ssh-copy-id -i ~\/.ssh\/id_rsa.pub user@host<\/code><\/td>Multiple keys<\/td>Install a specific key<\/td>Useful when default key is not desired<\/td><\/tr>
Manual key append over SSH<\/td>No ssh-copy-id<\/code> installed<\/td>cat ~\/.ssh\/id_ed25519.pub | ssh user@host \"...\"<\/code><\/td>Works broadly, but permissions must be correct<\/td><\/tr>
ssh -i ~\/.ssh\/key user@host<\/code><\/td>Troubleshooting identity selection<\/td>Force a specific private key for login<\/td>Helpful when several keys exist locally<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Optional server hardening (after successful key login)<\/h2>\n\n\n\n
Only harden SSH after confirming a non-root user can log in with keys. Older examples often show PermitRootLogin without-password<\/code>; many modern OpenSSH setups use PermitRootLogin prohibit-password<\/code> for the same intent.<\/p>\n\n\n
# \/etc\/ssh\/sshd_config<\/span>\nPermitRootLogin prohibit-password\nPasswordAuthentication no\nPubkeyAuthentication yes<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n
# Validate config, then reload service<\/span>\nsudo sshd -t\nsudo systemctl reload sshd\n\n# On some distributions, service name is ssh<\/span>\nsudo systemctl reload ssh<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Troubleshooting quick checks<\/h2>\n\n\n\n