Generate a key pair with ssh-keygen. Modern standard is Ed25519 (fast, secure, small keys). Older RSA keys are also supported but larger.
$ ssh-keygen -t ed25519 -C "user@host" $ ssh-keygen -t rsa -b 4096 -C "user@host" # older standard
This creates ~/.ssh/id_ed25519 (private key) and ~/.ssh/id_ed25519.pub (public key). Protect the private key with a passphrase. The passphrase encrypts the private key file—if someone steals it, they can't use it without the passphrase.
Generating public/private ed25519 key pair. Enter file in which to save the key (/home/user/.ssh/id_ed25519): Enter passphrase (empty for no passphrase): Enter same passphrase again:
The public key is safe to share. Copy it to servers and add to ~/.ssh/authorized_keys:
$ ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host
Or manually:
$ cat ~/.ssh/id_ed25519.pub | ssh user@host "cat >> ~/.ssh/authorized_keys"
File permissions matter:
$ chmod 700 ~/.ssh # directory $ chmod 600 ~/.ssh/id_ed25519 # private key $ chmod 644 ~/.ssh/id_ed25519.pub # public key $ chmod 644 ~/.ssh/authorized_keys # on server
View key fingerprint: ssh-keygen -lf ~/.ssh/id_ed25519.pub. Never share your private key.