Complete guide for Generating, Activating, and Using SSH Keys for SSH Access to Ubuntu Server

1. Generating ed25519 SSH Keys

   On a computer (Windows / Mac / Linux) that is not connected to the server via SSH (if it is, log out), in the command line or terminal, enter the command:

   ssh-keygen -t ed25519 -C "your_email_address@example.com, PC name"
   • the -t parameter defines the key type ed25519
   • the optional -C parameter adds a comment linking the key to a specific user and computer.

   Confirm/determine the new path and file name (so you can easily recognize them) where the keys will be stored and in the next step create, enter, and confirm by re-entering a security phrase, which will act as the actual password for the private SSH key. Be aware that if you forget the security phrase, it cannot be recovered.

   Two SSH keys are generated in the folder specified in the previous step.

2. Finding the Public Key

   The public SSH key is a file with the ".pub" extension. Its contents can be accessed by opening it via the Command Line / Terminal.

   On Windows
   type %USERPROFILE%\.ssh\file_name.pub
   On Mac / Linux
   cat ~/.ssh/file_name.pub

   The public key starts with the type "ssh-ed25519 AAAAC..."

3. Remotely Log into the Server Using Username and Password

   1. Connect the computer (from which we are remotely connecting) and the server (to which we are connecting) to the same local network (same router).
   2. Remotely connect to the server
      On Windows
      • Start the Putty client installed on the computer, go to the "Sessions" tab.
      • Enter the "Host" field indicating the server's IP address (found in the router) and the port through which we connect to the server (default is 22 - we will disable it in later steps, but use it now).
      • In the opened command line window, enter the username and password for connecting to the server (defined during server installation).
      On Mac / Linux
      • Start the terminal.
      • In the terminal, enter the ssh command linking to the specific user, server IP, and port:
        ssh username@server_ip -p 22

        Note: The ssh command works with default key-based authentication. If it is not specified in the ssh command, the computer tries all known hosts. If there are many known hosts servers on the computer from which we are logging in, we might exceed the maximum number of attempts and get a denial from the server with the notification "Too many authentication failures" because none of the used keys was valid for our server. The fix is simple, clearly specify the authentication method, in this case, a password.

        ssh -o IdentitiesOnly=yes -o PreferredAuthentications=password username@server_ip -p 22
      • Enter the password to connect to the server (defined during server installation).

4. Uploading the Public Key to the Server

   1. On the server, create a folder for storing public SSH keys with the command mkdir -p ~/.ssh.
   2. Open the authorized_keys file with the command nano ~/.ssh/authorized_keys and insert the public key found in step 1. (insert the entire line starting with ssh-ed25519 ...)
   3. Save and close the "authorized_keys" file by pressing ctrl+x.
   4. End the connection to the server with the command exit.

5. Remote Login to the Server Using a Private SSH Key

   On Windows

   If using Windows OS and the Putty client, the format of the private key generated in step 1 (file without extension) is not supported by the Putty client. It is therefore necessary to convert it, as follows:

   1. Display the private key with the command type %USERPROFILE%\.ssh\file_name and copy it exactly as it is, including "-----BEGIN OPENSSH PRIVATE KEY-----" and "-----END OPENSSH PRIVATE KEY-----" into a .txt file, which we save.
   2. Download the program "puttygen.exe (a RSA and DSA key generation utility)" from the official Putty website.
   3. Open the downloaded "PuTTY Key Generator", at the bottom select the type "EdDSA" → (Ed25519). At the top bar, choose "File → Load private key". Switch to displaying "All Files (*.*)" and select the .txt file in which we saved the private key. Enter the passphrase, which was defined during the key creation. If everything goes through, we receive the notification "Successfully imported foreign key...".
   4. Press the "Save private key" button and save the private SSH key in a Putty-supported .ppk format again into the .ssh folder. If anything is unclear, the procedure with screenshots can be found here.
   5. Open Putty client, go to "Connections → SSH → Auth → Credentials" and in the "Private key file for authentization" field select "Browse" and choose the .ppk file saved in the previous step.
   6. Go to the "Session" section, fill in the "Host" and "Port" fields, and after pressing the "Open" button, in the newly opened command window, enter the username (login as:), at which point instead of a password request, we should see the identification of the public key, within which we are connecting with a request to insert the passphrase.
   7. Enter the passphrase and log in.
   On Mac / Linux
   ssh username@server_ip -p 22 -i ~/.ssh/private_key

SSHD configuration

SSH login settings for the entire system and individual users can be configured in the /etc/ssh/sshd_config file. It can be opened with the following command:

sudo nano /etc/ssh/sshd_config

Since the file is opened with sudo and with write permissions, your user password (the password you use to log into the server) may be required to open it.

The file /etc/ssh/sshd_config contains definitions according to the needs of SSH logging, as below. Although the change itself does not lead to automatic logout, for security reasons, it is advisable to be connected to the server in 2 instances (2 windows), so that in case of a test logout in one and inability to log in again, you still have the possibility to revert the changes from the second window.