Set up SSH keys: ssh-keygen, ssh-copy-id and ~/.ssh/config

An SSH key is a pair of files. The private key stays on your computer and must never be shared. The public key (the .pub file) is safe to hand out: you put it on every server or Git host you want to log in to. When you connect, SSH proves you hold the private key without ever sending it.

1. Create a key

Use the ed25519 type. It is short, fast and supported by current OpenSSH servers and the major Git hosts.

ssh-keygen -t ed25519 -C "[email protected]"

Press Enter to accept the default location ~/.ssh/id_ed25519. When asked for a passphrase, set one: it encrypts the private key on disk, so a stolen laptop backup does not mean a stolen key. The -C text is just a label to help you recognize the key later.

You now have two files:

~/.ssh/id_ed25519      # private key: keep secret, permissions 600
~/.ssh/id_ed25519.pub  # public key: this is what you share

2. Avoid retyping the passphrase

An SSH agent remembers the unlocked key for your session.

eval "$(ssh-agent -s)"        # start an agent if one is not running
ssh-add ~/.ssh/id_ed25519      # unlock the key once

On macOS you can store the passphrase in the system keychain with ssh-add --apple-use-keychain ~/.ssh/id_ed25519. Many Linux desktops start an agent for you automatically.

3. Put the public key on a server

If you can still log in with a password, ssh-copy-id does everything: it appends your public key to ~/.ssh/authorized_keys on the server and sets sensible permissions.

ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]
ssh [email protected]     # should no longer ask for the account password

If ssh-copy-id is not available (it is not shipped with Windows), copy the single line from the .pub file and append it to ~/.ssh/authorized_keys on the server yourself. On the server, ~/.ssh must be 700 and authorized_keys 600, or the SSH server may ignore them.

For GitHub, GitLab and similar hosts, paste the contents of the .pub file into the SSH keys page of your account settings, then test with ssh -T [email protected].

4. Add shortcuts in ~/.ssh/config

Instead of typing users, ports and key paths every time, describe each host once:

Host web1
    HostName 203.0.113.10
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Host github.com
    User git
    IdentityFile ~/.ssh/id_ed25519

Host *
    AddKeysToAgent yes
    ServerAliveInterval 60

Now ssh web1 connects as deploy on port 2222 with the right key, and the alias also works with scp, rsync and Git (git clone web1:repo.git). SSH uses the first value it finds for each setting, so put specific hosts above the catch-all Host * block. IdentitiesOnly yes makes SSH offer only the listed key, which avoids “too many authentication failures” when you have many keys loaded.

The config file should be readable only by you: chmod 600 ~/.ssh/config.

Good habits

• Use one key per device, so you can revoke a lost laptop’s key without touching the others.
• Never copy your private key into a repository, chat or ticket. If that happens, delete the public key from every server and host, and create a new pair.
• Remove keys you no longer use from authorized_keys and from your Git host settings.