{"id":423,"date":"2020-10-15T01:31:06","date_gmt":"2020-10-15T01:31:06","guid":{"rendered":"https:\/\/dft.wiki\/?p=423"},"modified":"2026-06-09T14:31:48","modified_gmt":"2026-06-09T18:31:48","slug":"ssh-keys-to-access-your-server","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=423","title":{"rendered":"Setting Up and Copying SSH Keys"},"content":{"rendered":"

Creating an SSH key is the safest way to access your server.<\/p>\n

On your client machine, type:<\/p>\n

ssh-keygen -t rsa-sha2-512 -b 4096 -C \"user@domain.com\"<\/pre>\n
Or, for an elliptic curve alternative:<\/p>\n
ssh-keygen -t ed25519 -C \"user@domain.com\"<\/pre>\n
It will ask for a location; just hit “Enter”. If you want a passphrase, type and confirm it. The key is now created.<\/p>\n
To change the passphrase of a private key:<\/p>\n
ssh-keygen -p -f ~\/.ssh\/id_dsa<\/pre>\n
Or simply:<\/p>\n
ssh-keygen -p<\/pre>\n
To manually extract the public key from the private key:<\/p>\n
ssh-keygen -y -f ~\/.ssh\/id_rsa > ~\/.ssh\/id_rsa.pub<\/pre>\n
The entire directory must be protected from being read by other users:<\/p>\n
chmod 700 -R ~\/.ssh<\/pre>\n
To transfer your key to the server:<\/p>\n
ssh-copy-id user@domain.com<\/pre>\n
Enter the password you normally use to log in to your server.<\/p>\n
The public key can also be installed manually by appending id_rsa.pub<\/strong> to authorized_keys<\/strong>.<\/p>\n
cat ~\/.ssh\/id_rsa.pub >> ~\/.ssh\/authorized_keys<\/pre>\n
To check the algorithm of an existing key:<\/p>\n
ssh-keygen -l -f ~\/.ssh\/id_rsa<\/pre>\n
Done!<\/strong> Now try connecting again.<\/p>\n
ssh domain.com<\/pre>\n
If you did everything correctly, you are now logged in.<\/p>\n
It is always a good idea to have a second account ready in case you make a mistake and lock yourself out. If that happens, log in with the second account, switch to your user or root, and delete the files inside the ~\/.ssh\/ folder.<\/p>\n
As a good practice, protect your SSH configuration as much as possible. Edit the config file:<\/p>\n
sudo nano \/etc\/ssh\/sshd_config<\/pre>\n
Parameters you should pay attention to:<\/p>\n
AllowUsers user<\/strong>\r\nPermitRootLogin no\r\nPubkeyAuthentication yes\r\nPasswordAuthentication no\r\nPermitEmptyPasswords no<\/pre>\n
Replace “user<\/strong>” with your own username. Then restart the SSH service:<\/p>\n
sudo systemctl restart sshd.service<\/pre>\n
Consider adding an SSHFP<\/strong> (SSH Fingerprint) record to your DNS<\/strong> zone. It requires the following information:<\/p>\n