A password can be guessed a thousand times a second by a machine that never sleeps. A key cannot: there is nothing short enough to try. Switching costs ten minutes and removes a whole class of attack.

Generate the pair

ssh-keygen -t ed25519 -C "you@yourmachine"

Ed25519 is the current default: short, fast and strong. Give it a passphrase - if the laptop is stolen, the passphrase is the only thing between the thief and your servers.

Install the public half

ssh-copy-id ops@your-server

That appends the public key to ~/.ssh/authorized_keys on the server. The private half never leaves your machine and never should.

Test it in a NEW window

Do not close the session you are in. Open a second terminal and log in with the key. If it fails, you still have the first window to fix it from.
ssh ops@your-server

Then turn passwords off

# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
# then
systemctl reload ssh

Reload, not restart: reload keeps existing sessions alive, so a mistake does not disconnect you.

When it does not work

  • Permissions. SSH refuses keys in a directory anyone else can read: chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys
  • The wrong user. The key goes in the home directory of the user you log in as, not root's.
  • Read the reason. ssh -v ops@server prints every key it offers and why each was refused.
One key per machine, not one key copied to every machine. When a laptop is lost you remove one line on the server, and nothing else changes.