# SSH connection with public key

> Connect in SSH to a remote server using a public key (without login/password).

Published on 2021-10-21 | Updated on 2025-01-12 | Tags: ssh

https://xsec.fr/en/gnu-linux/ssh-certificate/

---

import Callout from '@shared/components/Callout.astro'
import { Collapsible } from '@shared/components/ui/collapsible'
import { Tabs, Tab } from '@/components/ui/tabs'

Connect with a public key rather than a User/Password represents several advantages:

- a generated key will always be more robust than a password in general
- there is no need to use a password to connect to SSH

## Generation of the key

- Choose the key type according to the server capabilities. Ed25519 is recommended on modern systems, while RSA 4096 remains useful for compatibility with older servers.

<Tabs tabs={["Ed25519 (recommended)", "RSA 4096 (compatibility)"]} client:load>
<Tab>

```sh title="Generate an Ed25519 key"
ssh-keygen -t ed25519
```

</Tab>
<Tab>

```sh title="Generate an RSA 4096 key"
ssh-keygen -t rsa -b 4096
```

</Tab>
</Tabs>

<Callout variant="tip">
Avoid DSA, which is obsolete. Protect the private key with a passphrase as well.
</Callout>

```txt title="ssh-keygen -t ed25519"
GENERATING PUBLIC/PRIVATE ED25519 KEY PAIR.
Enter File in Which to Save the Key (/home/contact/.ssh/id_ed25519):
Created Directory '/home/Contact/.ssh'.
Enter Passphrase (Empty for No Passphrase):
Enter SADS PASSPHRASE Again:
Your identification has been saved in /home/contact/.ssh/id_ed25519
Your public Key has been saved in /home/contact/.ssh/id_ed25519.pub
The Key Fingerprint is:
Sha256: Monhash Contact@Mondomain
The Key's Randomart Image is:
+-[Ed25519 256]-+
|%@+.|
| EBCVB.|
|+= BO.|
|+.O*.|
| oo..o.S S |
| =+oo o |
| B ++ o..|
|+= .. o.|
| o...|
+---- [SHA256] -----+
```

## Inform connection information

```sh
ssh-copy-id contact@mydomain
```

`ssh-copy-id Nom_user@ip_ou_domaine`

```txt title="ssh-copy-id admin@dns.it.fr"
/usr/bin/ssh-copy -id: info: source of key (s) to be installed: "/root/.ssh/id_rsa.pub"
The Authenticity of Host 'DNS.it.fr (172.16.10.10)' Can't Be Established.
ECDSA Key FingerPrint is sha256: LDA9PSN+R3COE3P2EH2HDAR6F50GATNLUTF5HW+QQKA.
Are you sure you want to continue connecting (Yes/No/[Fingerprint])?Yes
/usr/bin/ssh-copy-Iid: info: attempting to log in with the new key (s), to filter out any that are alreni installedy
/usr/bin/ssh-copy-ID: info: 1 key (s) remain to be installed-if you are prompt now it is to install the keys
admin@dns.it.fr's password:

Number of Key (s) Added: 1

Now Try Logging Into the Machine, with: "ssh 'admin@dns.it.fr'"
and check to make sure that only the key (s) you wanted were added.
```

## Connect to SSH

```sh
ssh admin@dns.it.fr
```

`ssh nom_user@ip_ou_domaine`

<Callout variant="tip">
You are now connected in Shh thanks to the authorization key.
</Callout>

<Collapsible client:load title="Export the authorization key">

```sh
cat .ssh/authorized_keys
```

```txt title="cat .ssh/authorized_keys"
SSH-RSA AAAAB3NZAC1C2EAAAADAQABAABGQC/3HQOJNQS9OCUAKIFAMOB4TWLZFSGF50VAO7H7AT3
FIMZ+HQEKTTMDS8CXOJAHA1J+4Z4+2HFHBVO5EXL4/HMYZTMBJZVEIMAK+J5UXNRZX6EBVL6BTZG7W
EK5IFRRTBLVIDGKQRI4E1DV8C7NUPDQBAGTIS3+UW3MIWKKNY6HVGJ6TIQT1ELRI38CVUX26PCUG
6FBVHQXOXTBWLOJUXZYD2NAYH4ZLVYR34KTPYCNKAOVFAYRSNBVCQ3A7XQWLUURPYOAJTNDWCBUI4EKO
ISTFQVGC7BT9SCPMYYKLB+D58QOWL74VELOQIRUDGC0O66ZX3BCTKU6DW9AGI/LWDODJLQHQQDIHKDIHKDIHKDIHKDIHK
G15VIGNCNTCY4F9P+KCG3G2TP+KNXMMBTUWll8mma6odLGLFTPAXJXJS+L9CPEOUWT2SKGHGXPUXFL
Lmtnqfsjmtbzhh5ywb0eq8fyvnbisj02t0jd8goq6qcia+7rwou15vu+hip5qrcu17cejze = root@
PC-Admin
```

</Collapsible>