Generate a key pair on your client, add its public key to the correct server account, and verify that key-based login works before disabling password authentication. Keep your current SSH session open until a new connection succeeds; otherwise, a configuration mistake or missing key could lock you out.
What changes when you switch to SSH keys?
SSH key login uses a public/private key pair. The private key stays on the computer you connect from; the server stores the matching public key in the account’s authorized keys file. When you connect, the key pair lets the server authenticate you without accepting an account password.
As an Amazon Associate I earn from qualifying purchases.
Disabling password authentication changes what the SSH server will accept. It does not install a key for you, and it does not necessarily disable every interactive authentication method. The steps below use Ubuntu Server paths and commands; other distributions and managed hosts may use different configuration and service procedures.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →1. Generate a key pair on your client
On the computer you will connect from, run:
ssh-keygen -t ed25519Choose a strong passphrase when prompted. Ubuntu recommends Ed25519 for its ordinary setup and documents RSA 4096-bit as an alternative if Ed25519 is unavailable in a constrained environment. Client defaults can vary; Ubuntu’s documented default files are ~/.ssh/id_ed25519 for the private key and ~/.ssh/id_ed25519.pub for the public key. See Ubuntu’s OpenSSH server guide.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Keep the private key file private and on the client. Do not copy it to the server.
- Only the public key—the file ending in
.pub—belongs in the server account’s authorized keys. - A passphrase helps protect the private key if someone gains access to its file. Ubuntu notes that
ssh-agentcan reduce repeated passphrase prompts.
2. Install the public key for the intended account
While you can still use the server’s existing login method, Ubuntu documents ssh-copy-id as the convenient way to install the key:
ssh-copy-id username@target_machineReplace username with the account you intend to use and target_machine with the server’s hostname or address. The command appends the public key to that remote account’s ~/.ssh/authorized_keys file. OpenSSH’s documented default authorized-key paths include .ssh/authorized_keys and .ssh/authorized_keys2, though server configuration can change the paths; see the OpenBSD sshd_config(5) reference.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If ssh-copy-id is unavailable, append the contents of your public key file to the correct account’s authorized keys file using a trusted method. Check the account and host carefully: a valid key installed for a different user will not authorize the login you intend.
3. Test key login before changing server settings
Open a second terminal and connect as the intended account. If your client does not select the new key automatically, specify it explicitly:
ssh -i ~/.ssh/id_ed25519 username@target_machineConfirm you can establish a new session using the key while leaving your existing administrative session open. Do not proceed until this test succeeds. Ubuntu warns that disabling password access without a usable approved key can leave you unable to log in; see its SSH configuration guidance.
4. Disable password authentication on Ubuntu
In the server’s existing session, inspect /etc/ssh/sshd_config and the included configuration snippets under /etc/ssh/sshd_config.d/. Ubuntu’s main configuration includes files matching that directory’s pattern, so a local or provider-supplied snippet may affect the effective setting.
Set this directive in the effective server configuration:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsPasswordAuthentication noKeep public-key authentication enabled. OpenSSH documents PubkeyAuthentication as enabled by default in the cited reference, but check the effective configuration rather than relying on a default. The OpenSSH reference defines PasswordAuthentication as the setting that specifies whether password authentication is allowed.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check keyboard-interactive authentication separately
PasswordAuthentication and KbdInteractiveAuthentication control separate OpenSSH authentication methods. Turning off password authentication alone does not necessarily turn off every password-like or interactive prompt. Keyboard-interactive authentication may be part of a PAM, multi-factor, or other challenge-response setup.
Set KbdInteractiveAuthentication no only if your policy also forbids that method and you have confirmed that no required authentication flow depends on it. OpenSSH describes keyboard-interactive separately, and Ubuntu’s manual lists both password and keyboard-interactive among available authentication methods. Review the OpenSSH configuration reference and Ubuntu’s sshd_config manual for the relevant settings.
5. Validate, apply, and verify the change
Use the configuration-validation and service reload or restart procedure documented for your operating system and deployment. There is no single apply command established here for every distribution, cloud image, or managed host, so do not assume an Ubuntu procedure applies elsewhere.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Validate the server configuration using the procedure for your platform.
- Apply the change using that platform’s documented service procedure, keeping your existing session open.
- Open a new connection and confirm that it authenticates with the intended key.
- Only after the new connection works should you close the original session.
If the new connection fails, use the still-open session or an out-of-band provider console to correct the configuration or restore access. The alternative recovery path matters because a user without an approved key may no longer have an ordinary SSH login route.
Key login versus password login
| Question | Key-based login | Password login |
|---|---|---|
| What must be available? | The client must have the private key, and the matching public key must be authorized for the server account. | The server must permit password authentication, and the user must know the account password. |
| What happens if the credential is unavailable? | Without the approved private key, ordinary key login cannot proceed; another tested access path may be needed. | Without the password, password login cannot proceed; another permitted authentication method may be needed. |
| Can the credential file be protected? | A passphrase can protect the private key file; an agent can help avoid entering it for every use. | The account password is entered for authentication; this setup does not use a private-key file. |
These are operational differences, not measured comparisons of compromise or failure rates. The cited sources do not establish numerical superiority claims.
Quick Recap
Before you close your current session
- A new connection works for the intended username and host.
- The matching public key is in that account’s authorized keys file.
- The private key remains on the client and is protected with a passphrase.
- The effective server configuration disables password authentication without unintentionally breaking a required keyboard-interactive or MFA flow.
- You have a working recovery route, such as the open session or provider console, until the change is verified.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
