iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To enable SSH key login, create or locate a key pair on your computer, add the matching .pub key to the server account’s accepted-key file, then connect using the matching private key. The private key stays on your computer; only the public key goes to the server.
Before you begin: identify the account and server
SSH user keys authorize a client to log in as a particular server account. They are different from the server’s host keys, which identify the server to clients. You need the remote account name, server address, and an existing way to access the server or have an administrator install the key for you.
The instructions below assume an OpenSSH server. Linux and macOS servers using standard OpenSSH conventions typically accept keys in ~/.ssh/authorized_keys, but a server administrator can configure a different location with AuthorizedKeysFile. macOS-specific server instructions are not independently established here, so confirm the active SSH configuration if it differs from the standard OpenSSH setup.
1. Generate or locate a key pair on your computer
If you already have an SSH key pair, find the public-key file that matches the private key you intend to use. The public file usually ends in .pub. If you need a pair, run:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
ssh-keygenFollow the prompts to choose a save path and, if desired, a passphrase. Key-type support and organizational policy depend on your OpenSSH version and environment. Microsoft’s current Windows documentation lists DSA, RSA, ECDSA, and Ed25519 support and identifies Ed25519 as the default when no algorithm is specified; this does not make one type universally appropriate for every deployment. See Microsoft’s OpenSSH key-management guidance and the OpenSSH ssh-keygen manual.
Keep the private key on the client and protect it as a credential. Do not copy it to the server or send it to an administrator. The public-key file contains the key line intended for installation; OpenSSH documents adding its contents to the destination account’s authorized_keys file.
2. Add the public key to a standard OpenSSH account
For a typical Linux account—and a standard OpenSSH account on another operating system—the default file is ~/.ssh/authorized_keys in the target user’s home directory. OpenSSH’s sshd manual documents the accepted-key file and notes that its location can be configured.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
-
On the server, use the target account to create the SSH directory if it does not already exist:
mkdir -p ~/.ssh -
Append the complete public-key line to that account’s file. For example, if the public key is on your client at
~/.ssh/id_ed25519.pub, you can usessh-copy-id username@serverwhen the client has that utility and you can authenticate to the server by password or another method. Alternatively, transfer the public file withscpor use an authorized server session to append its contents. The key must be installed under the account you intend to log in as. -
Ensure the file contains the whole key on one line, without wrapping or truncation. A key line typically starts with a key type, followed by encoded key data and optionally a comment. The comment is an identifier, not part of the secret. The file is plain text; blank lines and lines beginning with
#are ignored.Rank #3
Yubico - YubiKey 5 NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-A or NFC, FIDO Certified - Protect Your Online Accounts- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
-
Apply permissions appropriate to the server. OpenSSH recommends that the user’s
.sshdirectory andauthorized_keysfile not be accessible by other users; permissive or otherwise incorrect ownership and permissions can cause the server to reject a key. Follow the server administrator’s policy if it is stricter.Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
3. Install a key on a Windows OpenSSH server
Windows uses different key-file paths depending on the account type. First make sure the OpenSSH Server component is installed, the sshd service is running, and the inbound firewall rule allows SSH connections. Installation state and setup steps vary by Windows release; Microsoft documents service startup, automatic startup, and firewall checks in its OpenSSH installation and first-use guidance.
| Account logging in | Accepted-key file | Permission requirement |
|---|---|---|
| Standard Windows user | C:Usersusername.sshauthorized_keys |
Use appropriate Windows file permissions for the account and server configuration. |
| Member of the local Administrators group | C:ProgramDatasshadministrators_authorized_keys |
ACL entries must be limited to NT AuthoritySYSTEM and BUILTINAdministrators. |
For an administrator account, do not use the profile’s .sshauthorized_keys path in place of the shared administrator file. Microsoft provides the required ACL procedure and an icacls command in its Windows OpenSSH key-management documentation. Unix chmod instructions do not set Windows ACLs.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft documents this key-authentication flow for local and Active Directory accounts, but not Microsoft Entra ID accounts. Windows OpenSSH also does not support AuthorizedKeysCommand or AuthorizedKeysCommandUser; those are Windows-specific limitations, not general OpenSSH rules.
4. Test the connection from Linux, macOS, or Windows
From a terminal with an OpenSSH client, try:
ssh username@serverIf the private key is not in a default location or loaded into an agent, specify it explicitly:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ssh -i path/to/private_key username@serverReplace the example username, server address, and key path with your actual values. If the connection fails, add -v to inspect client-side diagnostic output:
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
ssh -v -i path/to/private_key username@serverWhy does SSH say “Permission denied (publickey)”?
That message means the server did not accept a public key for the login attempt. Check the following in order:
- Username and host: Confirm that you are connecting to the intended server as the account where the key was installed.
- Account-specific path: Check the standard account’s
~/.ssh/authorized_keys, or the Windows administrator file when the account belongs to the local Administrators group. - Key contents: Confirm the full public-key line was copied intact into the accepted-key file and corresponds to the private key offered by the client.
- Permissions or ACL: On OpenSSH systems, check ownership and access on the home directory,
.ssh, andauthorized_keys. On Windows, verify the ACL rules required for the relevant account type. - Server configuration: Ask the administrator whether
AuthorizedKeysFilepoints somewhere other than the default, and whether the server is configured to accept public-key authentication.
Microsoft’s Windows SSH connection troubleshooting guide lists missing or incorrect authorized_keys files and improper permissions among possible causes of public-key failures.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
