Multi-platformsecurityTested on real hardware

Generate an SSH key pair (Linux / macOS / Windows)

Create an Ed25519 SSH key pair and copy the public key to a remote server. Works identically on Linux, macOS, and Windows 10+ with the built-in OpenSSH client.

Shellbash
Updated
Script
bash
# Works on Linux, macOS, and Windows PowerShell (OpenSSH built-in since Windows 10 1809)

# Generate an Ed25519 key pair (recommended — compact, fast, and secure)
# Replace the email with your own — it's just a label on the public key
ssh-keygen -t ed25519 -C "you@example.com"

# Accept the default file location (~/.ssh/id_ed25519) by pressing Enter
# Enter a strong passphrase when prompted (highly recommended)

# Display your public key — this is what you share/copy to servers
cat ~/.ssh/id_ed25519.pub

# Copy the public key to a remote server (Linux / macOS)
ssh-copy-id -i ~/.ssh/id_ed25519.pub youruser@server-ip

What this does

Generates an Ed25519 SSH key pair:

  • Private key (~/.ssh/id_ed25519) — stays on your machine, never shared
  • Public key (~/.ssh/id_ed25519.pub) — copied to servers you want to access

Once the public key is on a server, you can authenticate without a password. Ed25519 is the recommended algorithm — it is faster than RSA, produces shorter keys, and is considered more secure.

Why this approach

SSH key authentication is the single most impactful security change you can make to a server you access remotely. A password can be guessed, phished, reused from another breach, or leaked — and internet-exposed SSH servers receive automated brute-force attempts within minutes of coming online. A key pair cannot be guessed: the private key never leaves your machine, and the public key on the server is mathematically useless to an attacker without the matching private. Once keys are in place and password auth is disabled, the brute-force attack surface is gone entirely.

Ed25519 is the recommended algorithm because it uses elliptic curve cryptography (specifically Curve25519, specified in RFC 8032) that produces short keys, authenticates quickly, and has no known practical weaknesses. RSA still works and has broader legacy compatibility, but for any system built after 2015 there’s no reason to use it — Ed25519 keys are stronger and 15× shorter. The 4096-bit RSA keys some guides recommend are heavier and still don’t match the security margin of Ed25519.

The passphrase on the private key is optional but important for any key that will access production or sensitive systems. Without a passphrase, anyone who gets a copy of the private key file (a stolen laptop, a backup leak) can use it immediately. With a passphrase, they’d also need to know it. The SSH agent (ssh-add) caches the decrypted key in memory so you only type the passphrase once per login session — you get the security without retyping it on every connection.

Prerequisites

  • Linux, macOS, or Windows 10 1809+ (OpenSSH client is built-in on all three)
  • For Windows: verify with ssh -V in PowerShell — you should see OpenSSH_...

Key file locations

OS Private key Public key
Linux / macOS ~/.ssh/id_ed25519 ~/.ssh/id_ed25519.pub
Windows C:\Users\You\.ssh\id_ed25519 C:\Users\You\.ssh\id_ed25519.pub

If you already have a key at the default path, press Enter at the filename prompt to keep the existing key, or specify a different name (e.g. ~/.ssh/id_homelab).

Copy the public key to a server

Linux / macOS:

ssh-copy-id -i ~/.ssh/id_ed25519.pub youruser@server-ip

Windows (PowerShell — ssh-copy-id is not built in):

$pubkey = Get-Content "$env:USERPROFILE\.ssh\id_ed25519.pub"
ssh youruser@server-ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && echo '$pubkey' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Use a passphrase — and the SSH agent

A passphrase encrypts the private key on disk. Use the SSH agent so you only unlock it once per session:

Linux / macOS:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Add to ~/.zshrc or ~/.bashrc to auto-start the agent at login.

Windows (PowerShell, run as Administrator — once):

Set-Service -Name ssh-agent -StartupType Automatic
Start-Service ssh-agent
ssh-add "$env:USERPROFILE\.ssh\id_ed25519"

Multiple keys for different servers

Specify which key to use per host in ~/.ssh/config:

Host proxmox-01
    HostName 192.168.1.10
    User root
    IdentityFile ~/.ssh/id_homelab

Host github.com
    IdentityFile ~/.ssh/id_github

RSA fallback (legacy systems only)

Some older servers or appliances don’t support Ed25519. Use RSA 4096-bit as a fallback:

ssh-keygen -t rsa -b 4096 -C "you@example.com"

Notes

  • The public key is safe to share — it is mathematically useless without the matching private key
  • Never copy or share id_ed25519 (no .pub extension) — that is the private key
  • Back up ~/.ssh/ somewhere secure; losing the private key means regenerating and re-copying the public key to every server
  • Pair with the SSH hardening playbook to disable password auth once key login is confirmed
All playbooks