How to generate and use SSH keys on Linux, macOS and Windows

SSH (Secure Shell) is a protocol used for secure remote access to servers and other network devices. When you connect to a server using SSH, you usually authenticate using a username and password. However, using SSH keys for authentication provides a more secure and convenient alternative.

SSH keys, generated with ssh-keygen, are a pair of cryptographic keys - a public key and a private key - that are used to authenticate and establish secure, encrypted connection between a client (such as your Linux or macOS computer) and a server using OpenSSH. The public key is placed on the server you want to access, while the private key remains on your local machine. When you attempt to connect to the server, the SSH protocol uses these keys to verify your identity and establish a secure connection without the need for a password.

Using SSH keys offers several benefits:

• Enhanced security: SSH keys are much harder to crack or guess compared to passwords, making your server access more secure.

• Convenience: Once you have set up SSH keys, you can connect to your server without having to enter a password each time, simplifying the login process.

• Automation: SSH keys enable you to automate server access for scripts and other tools, as you don't need to input a password manually.

In this guide, we will walk you through generating an SSH key pair with OpenSSH or PuTTY, saving the public key to your UpCloud Control Panel, and using it to log in to your Cloud Servers.

OpenSSH

To generate a new SSH key pair on Linux or macOS, open a terminal and run ssh-keygen. On Windows, the same command works in PowerShell when the OpenSSH Client feature is installed. If you'd rather use PuTTY on Windows, see PuTTY below.

ssh-keygen -t ed25519

This creates an Ed25519 key, which is the key type we recommend. Ed25519 keys are short, fast and secure.

If you need an RSA key, for example for an older system that doesn't support Ed25519, create a 4096-bit one instead:

ssh-keygen -t rsa -b 4096

Ubuntu 22.04 and later, Debian 12 and AlmaLinux 9 refuse RSA keys from SSH clients older than OpenSSH 7.2 or PuTTY 0.75, and the login fails with Permission denied (publickey). If that happens, update your SSH client or switch to an Ed25519 key.

The key generator asks where to save the key. Press Enter to use the default location, which is ~/.ssh/id_ed25519 on Linux and macOS.

Next, you can create a passphrase to protect your private key. If someone gets hold of the key file, they still can't use it without the passphrase. Type a passphrase and press Enter, then type it again to confirm. To continue without a passphrase, press Enter twice. Note that some automation tools might not be able to unlock passphrase-protected private keys.

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/alex/.ssh/id_ed25519):
Created directory '/home/alex/.ssh'.
Enter passphrase for "/home/alex/.ssh/id_ed25519" (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/alex/.ssh/id_ed25519
Your public key has been saved in /home/alex/.ssh/id_ed25519.pub
...

The public half of the key pair is saved next to the private key, with .pub at the end of the file name. Print it so that you can copy it:

cat ~/.ssh/id_ed25519.pub

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF/8/Hgwc9qq6+vm8S6AFDwIYUnduvl8JLtHWUo0+UJ7 alex@work-laptop

Copy the whole line, then add it to the Control Panel.

Use the SSH agent

If you protected your key with a passphrase, you can load the key into the SSH agent so that you don't have to type the passphrase every time you connect. Start the agent and add your private key:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Type the key's passphrase when asked.

Agent pid 2792
Enter passphrase for /home/alex/.ssh/id_ed25519:
Identity added: /home/alex/.ssh/id_ed25519 (alex@work-laptop)

The agent keeps the key unlocked until you close the terminal or restart your computer.

PuTTY

If you're using a Windows laptop or PC with the PuTTY SSH client, you can create a new SSH key pair with PuTTYgen, the key generator that comes with PuTTY.

Open PuTTYgen and select EdDSA under Type of key to generate. The curve below it is set to Ed25519 (255 bits), which is the key type we recommend. Then click Generate.

PuTTYgen asks you to generate some randomness. Keep moving your mouse over the blank area until the progress bar is full.

When the key is ready, PuTTYgen shows the public key at the top of the window.

You can enter an optional passphrase in the Key passphrase and Confirm fields. The passphrase protects your private key if someone manages to copy it.

Click Save private key and save the file somewhere safe on your computer. If you didn't enter a passphrase, PuTTYgen asks you to confirm that you want to save the key without one.

Next, copy the public key from the box under Public key for pasting into OpenSSH authorized_keys file. Right-click the key, choose Select All, then right-click again and choose Copy. Use the text from this box rather than the Save public key button, because the Control Panel needs the key in OpenSSH format. You don't need to save the public key separately, as PuTTYgen shows it again whenever you load the private key.

You can now add the public key to the Control Panel.

Add your public key to the Control Panel

You can add the public key on the server deployment page by clicking Add new under Login Method. You can also add it in Account > SSH keys, where you manage all the keys saved to your account.

Give the key a name that helps you recognize it later, paste the public key, and click Save.

The new key appears in your list of SSH keys.

When you deploy a new server, select the key under Login Method. Servers deployed with SSH keys have password login turned off, so you log in with your key.

When the deployment is complete, you can connect to the server with your key. For the steps with OpenSSH or PuTTY, see Connecting to your Cloud Server.

Add a key to an existing server

To use a new key on a server you already log in to, copy the public key to the server with ssh-copy-id. Replace user@server with your username and the server's address:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

ssh-copy-id logs in the way you normally do, with your password or an existing key, and adds the new key to the server. If the server asks for a password, enter your password on the server.

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/alex/.ssh/id_ed25519.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
user@server's password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh -i /home/alex/.ssh/id_ed25519 'user@server'"
and check to make sure that only the key(s) you wanted were added.

Newer SSH clients print the post-quantum warning when the server doesn't offer post-quantum key exchange. The warning doesn't stop the key from being added.

ssh-copy-id is available on Linux and macOS. With PuTTY, or with OpenSSH on Windows, log in to the server and add the public key as a new line at the end of ~/.ssh/authorized_keys.

Turn off password authentication

Servers deployed with SSH keys already have password login turned off. If you deployed your server with a one-time password, it accepts password logins until you turn them off. Once you can log in with your key, turn password login off to block brute-force attacks.

Do these steps while logged in to your server with your key. If you lose SSH access, you can still log in through the console on your server's Console tab in the Control Panel.

1. Open the SSH server configuration file:

sudo nano /etc/ssh/sshd_config

2. Find the PasswordAuthentication line and set it to no. If the line starts with #, remove the # as well.

PasswordAuthentication no

Then save and exit the editor.

3. Restart the SSH service to apply the change. On Ubuntu and Debian, run:

sudo systemctl restart ssh

On AlmaLinux, Rocky Linux and CentOS Stream, run:

sudo systemctl restart sshd

4. Check the settings that the SSH server now uses:

sudo sshd -T | grep -iE "^(pubkeyauthentication|passwordauthentication)"

pubkeyauthentication yes
passwordauthentication no

If passwordauthentication still says yes, another file in /etc/ssh/sshd_config.d/ sets it. Find it with sudo grep -ri passwordauthentication /etc/ssh/sshd_config.d/, set it to no there too, and restart the SSH service again.

5. Before you close your current session, open a new terminal and check that you can still log in with your key.

With that done, your cloud server is another step towards security. Malicious attempts to log in with a password are rejected, as the server no longer accepts passwords at all.

Remember to always keep your private keys safe. You can use the same key from multiple computers if you wish, or generate new ones on each client connecting to your cloud server for added security. Ideally, each user should generate their own key pair and passphrase for secure access control. With proper management, even if one of the private keys gets compromised, you won't have to replace them all.