Amar Vyas

SSH Basics: Keys, First Login, Essential Commands

2025-01-22 · Commandline · 6 min read

In Part 1, you learned what SSH is and made your first connection. Now we remove passwords from your daily workflow. This part covers generating a key pair, copying it to a remote server, fixing the file permissions Debian requires, and the handful of flags you will use every day. ssh on a VPS

Summaries

English:
This guide covers essential SSH client skills on Debian Linux. You will generate your first ed25519 key pair, copy it to a remote server with ssh-copy-id, and understand why ~/.ssh permissions matter. We explore basic flags like -p and -i, run single remote commands without opening an interactive shell, and safely manage stale fingerprints in known_hosts. By the end, you will log in faster and more securely than with passwords.

Hindi Summary:
यह गाइड Debian Linux पर आवश्यक SSH क्लाइंट कौशल को कवर करती है। आप अपनी पहली ed25519 कुंजी युगल बनाएंगे, ssh-copy-id से सर्वर पर कॉपी करेंगे, और ~/.ssh अनुमतियों को समझेंगे। -p और -i जैसे बुनियादी फ्लैग्स, एकल दूरस्थ कमांड्स, और known_hosts प्रबंधन शामिल हैं।

Generate Your First SSH Key Pair

SSH keys come in pairs: a private key that stays on your laptop and a public key you place on the server.

Choose Your Key Type

Modern Debian systems prefer Ed25519. It is shorter, faster, and more secure than RSA at default lengths.

ssh-keygen -t ed25519 -C "[email protected]"

Only use RSA if an old server rejects Ed25519:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

Where Debian Stores Keys

Your keys live in ~/.ssh/:

  • id_ed25519 — your private key. Never share this.
  • id_ed25519.pub — your public key. This goes on the server.

Passphrase: What and Why

ssh-keygen asks for a passphrase. This is not the remote password. It is a local lock on your private key. If someone steals your laptop, they cannot use the key without this phrase. Use a password manager if you worry about forgetting it.

Copy the Key to Your Server

The ssh-copy-id Command

The easiest way to install your public key is ssh-copy-id. It logs in with your password once, then copies the key.

ssh-copy-id [email protected]

You will be asked for your remote password one last time. After this, the server trusts your key.

Manual Fallback

If ssh-copy-id is unavailable, append the key manually:

cat ~/.ssh/id_ed25519.pub | ssh [email protected] "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

What Happens on the Server

Your public key is appended to ~/.ssh/authorized_keys. You do not need to edit this file yourself if ssh-copy-id works.

Fix File Permissions or SSH Will Refuse

Debian's SSH client is strict. If your key or directory is readable by others, SSH will refuse to use it.

The Exact chmod Commands

Run this on your local machine:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

The "UNPROTECTED PRIVATE KEY FILE" Error

If you see this warning, your permissions are too loose. Run the commands above. The private key must be exactly 600.

Essential SSH Flags

Flags save you from memorizing long addresses.

-p for Custom Port

If the server runs SSH on port 2222 instead of 22:

ssh -p 2222 [email protected]

-i to Specify an Identity

If you have multiple keys or a custom filename:

ssh -i ~/.ssh/custom_key [email protected]

-v for Troubleshooting

If a connection fails, add verbosity:

ssh -v [email protected]

Use -vv or -vvv for even more detail when debugging key issues.

Run One Command and Exit

You do not need an interactive session to fetch information:

ssh [email protected] "df -h"

This runs df -h on the remote machine and prints the result locally.

Managing knownhosts

Remove a Stale Entry

If a server is rebuilt and its fingerprint changes, SSH will block the connection. Remove the old entry:

ssh-keygen -R 192.168.1.50

Pre-populate Safely

If you know a server's fingerprint in advance, you can add it before connecting:

ssh-keyscan -H 192.168.1.50 >> ~/.ssh/known_hosts

Test Your Passwordless Login

Log out and reconnect:

ssh [email protected]

If everything is correct, you will see no password prompt. If you set a passphrase on your key, you may be asked for that instead of the remote password.

Debug Steps if Password Still Appears

  1. Check permissions: ls -l ~/.ssh/ should show drwx------ for the directory and -rw------- for the private key.
  2. Use -v to see which authentication methods SSH is trying.
  3. Ensure PubkeyAuthentication is enabled on the server. If not, you need Part 4.

Conclusion

You have replaced your password with a cryptographic key. You know how to copy it safely, fix permissions when Debian complains, and troubleshoot with a single flag. In Part 3, we will stop typing IP addresses. You will learn to alias servers, unlock keys automatically with an agent, and create encrypted tunnels.

Key Takeaways:

  • Use ed25519 for new servers; fall back to rsa -b 4096 only if required.
  • ssh-copy-id is the safest way to install your public key.
  • Local permissions (700 and 600) are as critical as the key itself.
  • ssh -v is your first troubleshooting step.
  • ssh user@host "command" runs remote commands without opening a shell.

Additional Sections

FAQ Section:

1. Can I use the same key on every server? Yes, but separate keys reduce blast radius if one is ever lost. We cover multiple keys in Part 3.
2. I forgot my key passphrase. Can I recover it? No. You must generate a new key pair and replace the old public key on your servers. Store passphrases in a password manager.
3. Why does the server still ask for my password? Either the key is not in authorized_keys, permissions are wrong, or the server has PubkeyAuthentication disabled. The last fix requires server-side changes covered in Part 4.

Call-to-Action:

Ready to manage multiple servers without memorizing IP addresses? Read Part 3 of this series to master ~/.ssh/config, ssh-agent, and tunneling.

Internal Links:

External Links:

This post was published under Commandline and last updated on 2026-07-20 .