Server with SSH Key only

Set Up SSH Key Authentication on Ubuntu

SSH key authentication allows you to connect to a server without using the account password.

For new keys, Ed25519 is recommended.

Generate an SSH Key on Windows

Open PowerShell:

ssh-keygen -t ed25519

Press Enter to use the default location.

The files will normally be created under:

C:\Users\YourName\.ssh\

Two files are created:

id_ed25519

id_ed25519.pub

id_ed25519 is the private key and should never be shared.

id_ed25519.pub is the public key that is added to the server.

Display the Public Key

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

Copy the complete public key.

Add the Public Key to the Server

For root:

sudo mkdir -p /root/.ssh

sudo chmod 700 /root/.ssh

Open:

sudo nano /root/.ssh/authorized_keys

Paste the public key on a new line.

Then set the correct permissions:

sudo chmod 600 /root/.ssh/authorized_keys

sudo chown -R root:root /root/.ssh

SSH Configuration

Open:

sudo nano /etc/ssh/sshd_config

Example:

Include /etc/ssh/sshd_config.d/*.conf

Port YOUR_SSH_PORT

LogLevel VERBOSE

LoginGraceTime 30

MaxAuthTries 3

PubkeyAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys

PermitEmptyPasswords no

KbdInteractiveAuthentication no

PasswordAuthentication no

UsePAM yes

X11Forwarding no

PrintMotd no

ClientAliveInterval 300

ClientAliveCountMax 2

AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

PermitRootLogin prohibit-password

Replace:

YOUR_SSH_PORT

with the SSH port configured on the server.

Root Login

PermitRootLogin prohibit-password

allows root login using an SSH key while preventing password-based root login.

Combined with:

PubkeyAuthentication yes

PasswordAuthentication no

SSH authentication will use keys instead of passwords.

If direct root SSH access is not required, use:

PermitRootLogin no

and connect with a normal sudo-enabled user instead.

Test the Configuration

Always check the configuration before applying changes:

sudo sshd -t

If no output is returned, the configuration syntax is valid.

To view the effective SSH configuration:

sudo sshd -T

Apply the Configuration

sudo systemctl reload ssh

Check the service:

sudo systemctl status ssh

Firewall

If using a custom SSH port, make sure it is allowed through UFW:

sudo ufw allow YOUR_SSH_PORT/tcp

Check:

sudo ufw status

Test the New Connection

Keep the existing SSH connection open while testing.

From another PowerShell window:

ssh root@SERVER_IP -p YOUR_SSH_PORT

If the key needs to be specified manually:

ssh -i $env:USERPROFILE\.ssh\id_ed25519 root@SERVER_IP -p YOUR_SSH_PORT

Only close the original SSH session after confirming the new key-based connection works.