Published: 09.07.2026
SSH is the standard way to manage a Linux server. The way you log in decides how hard it is for an attacker to get in. Keys are much stronger than passwords.
Why passwords are weak
Bots try thousands of common passwords every day on every public server. A weak or reused password will be found sooner or later, and a leaked password works from anywhere.
How keys work
A key pair has two parts: a private key that stays on your computer, and a public key that you place on the server. The server proves that you hold the private key without ever sending it. Guessing a key is practically impossible.
How to set up key login
- Create a key pair on your computer:
ssh-keygen -t ed25519. - Protect the private key with a passphrase.
- Copy the public key to the server:
ssh-copy-id user@server. - Test the login in a new window and keep the first session open.
- Disable password login by setting
PasswordAuthentication noin the SSH configuration, then reload the service.
Good practices
- Use one key per device, so a lost laptop can be removed alone.
- Store private keys in a password manager or a hardware token.
- Never copy a private key into a chat or an e-mail.
- Remove keys of people who left the team.
What if I lose the key?
Use the emergency console of your provider to add a new key. This is why a backup of the access method is important.
Frequently asked questions
Is a long password as good as a key? A strong random password helps, but it can still be intercepted or reused; keys cannot.
Can I use keys on Windows? Yes, with the built-in OpenSSH client or tools such as PuTTY.
