Passwordless SSH: Key-Based Login to Your Linux Server

If you SSH into the same Linux box a dozen times a day — a VPS, a DigitalOcean droplet, a home server — typing the password every time gets old fast. Worse, password logins are exactly what bots hammer all day long. The fix is SSH key-based authentication: you log in with a cryptographic key instead of a password, and once it's set up, ssh just lets you straight in.

Let me show you how to wire it up from your Linux machine to a remote server (I'll use a DigitalOcean droplet as the example, but this works for any Linux host).

How it works (the 30-second version)

You generate a key pair: a private key that stays secret on your machine, and a public key you can hand out freely. You put the public key on the server. When you connect, SSH proves you hold the matching private key — no password crosses the wire. The private key never leaves your computer.

Step 1: Generate a key (skip if you already have one)

First, check whether you already have a key:

ls ~/.ssh/*.pub

If that lists something like id_ed25519.pub, you're set — jump to Step 2. Otherwise, create one:

ssh-keygen -t ed25519 -C "your@email"

Press Enter to accept the default location (~/.ssh/id_ed25519). It'll offer to set a passphrase — I recommend one. It encrypts your private key so a stolen laptop doesn't hand over your servers. (If you want truly unattended logins, you can leave it blank, but understand the trade-off — see Choosing Strong Passwords for why a good passphrase matters.)

Note: ed25519 is the modern, fast, secure key type. You may still see rsa in old guides — ed25519 is the better default today.

Step 2: Copy your public key to the server

The easiest way is ssh-copy-id, which appends your public key to the server's ~/.ssh/authorized_keys and fixes the permissions for you:

ssh-copy-id user@droplet_ip

It'll ask for the server password this one time — that's the last time you'll need it.

If ssh-copy-id isn't installed, do it by hand:

cat ~/.ssh/id_ed25519.pub | ssh user@droplet_ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Step 3: Test it

ssh user@droplet_ip

You should land in a shell with no password prompt (just your key passphrase, if you set one). That's it — passwordless login is working.

Step 4: Lock the front door (recommended)

Now that keys work, turn off password logins so nobody can brute-force their way in. On the server, edit the SSH config:

sudo nano /etc/ssh/sshd_config

Set:

PasswordAuthentication no

Then reload SSH:

sudo systemctl restart ssh    # on some systems: sudo systemctl restart sshd

⚠️ Don't lock yourself out. Keep your current SSH session open, and open a new terminal to confirm you can still log in with your key before you close the first one. If something's wrong, you'll still have a way back in to fix it.

Quality-of-life tips

Stop typing the IP. Add an entry to ~/.ssh/config on your machine:

`` Host droplet HostName droplet_ip User youruser ``

Now ssh droplet is all you type.

New droplets, passwordless from boot. DigitalOcean (and most providers) let you register your public key in the dashboard — add it under Settings → Security → SSH Keys, and any droplet you create with it is key-ready on first boot.

Multiple machines? Run Steps 1–2 from each one. One key per machine is cleaner than copying a private key around — and if a machine is lost, you just remove that one key from authorized_keys.

Wrapping up

Key-based SSH is faster, safer, and once it's set up you'll never look back. Generate a key, drop the public half on the server, disable password auth, and you've both saved yourself the typing and shut down the single most common way Linux servers get popped.

If you found this useful, subscribe to our RSS Feed and YouTube Channel. More Linux and security writeups are on the way.