Every server login with a password is a tiny risk you can avoid. Passwords travel across the wire, they get reused, and they invite brute-force scanners. SSH keys fix that: a public key sits on the server, a private key stays with you, and the two match without ever sending your password. Once it is set up, ssh user@host just logs you in. No prompt, no guessing.
Here is the setup, five steps, all with real commands.
1. Generate an Ed25519 key
Run this locally:
ssh-keygen -t ed25519 -C "your comment"
Ed25519 is the modern default. It is faster, takes up less space, and is what OpenSSH recommends for new keys, so it works on any server running OpenSSH 6.5 or newer. The -C flag attaches a comment (your email or user@host) so you can tell keys apart later.
This writes two files in ~/.ssh/: id_ed25519 (your private key) and id_ed25519.pub (your public key). When it asks for a passphrase, set one. The passphrase encrypts the private key, so even if the file leaks, the key alone is not usable. The private key must also stay secret, and the server will refuse to use it if the file is world-readable. Keep it at chmod 600.
2. Install the public key on your server
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host
This connects to the server, appends your public key to ~/.ssh/authorized_keys, and creates that file if it is missing. It also sets the right permissions (700 on .ssh, 600 on authorized_keys). One catch: you still type your login password on this run. That is the last time.
3. Confirm it works
ssh user@host
If the key landed, you are in with no password. Keep that session open.
4. Use ssh-agent so you only unlock once
If you gave the key a passphrase, SSH asks for it on every connection unless you use the agent:
ssh-add ~/.ssh/id_ed25519
ssh-add loads the key into ssh-agent, your passphrase unlocks it once, and the agent serves the key for the rest of the session. To stop re-adding it by hand, tell your SSH config to do it for you. In ~/.ssh/config:
Host *
AddKeysToAgent yes
IdentityFile ~/.ssh/id_ed25519
Now the first SSH connection of a session asks for the passphrase, loads the key, and every later connection is silent.
5. Optional: turn off password login on the server
This is where you actually stop the brute-force noise. On the server, edit /etc/ssh/sshd_config:
PasswordAuthentication no
Then reload the daemon:
sudo systemctl restart sshd
Before you save and restart, do this: open a second terminal, connect with your key, and confirm it works while the first session stays logged in. If your key login fails, undo the change. Reloading only applies to new connections, so a running session is your safety net. Once you are sure the key works everywhere, password authentication is gone and the scanners have nothing to probe.
That is the whole setup. Generate, copy, test, load into the agent, and only then shut the door. Five steps, one password you will never type again.