How to Create an SSH Key and Copy It to a Server: Linux and Windows

A root password can be guessed — a key can’t. Key-based SSH login takes five minutes to set up and closes the most common way servers get hacked: password brute-forcing.

How it works

An SSH key is a pair of files. The private key (id_ed25519) stays on your computer and is never shared. The public key (id_ed25519.pub) is copied to the server into the authorized_keys file. When you connect, the server checks that you hold the private key of that pair — no password is sent over the network at all.

One key can be placed on any number of servers. If a laptop is stolen or an employee leaves, just remove their public key from authorized_keys — no need to change passwords on every server.

Step 1. Create a key on Linux or macOS

Open a terminal and run:

ssh-keygen -t ed25519 -C "ivan@company.uz"

Press Enter when asked for the path — the key is saved to ~/.ssh/id_ed25519. Then set a passphrase: if the private key is stolen, it can’t be used without it. Leave the passphrase empty only for keys used by scripts and backups.

If the server is old and doesn’t support ed25519 (CentOS 6 and earlier), create an RSA key: ssh-keygen -t rsa -b 4096.

Step 1. Create a key on Windows 10 and 11

Windows 10 (1809 and later) and Windows 11 ship with the OpenSSH client. Open PowerShell — no administrator rights needed — and run the same command:

ssh-keygen -t ed25519 -C "ivan@company.uz"

The keys appear in C:\Users\YOUR_NAME\.ssh\. If the command isn’t found, enable it: “Settings → Apps → Optional features → OpenSSH Client”.

PuTTY. If you connect with PuTTY, create the key in PuTTYgen: type EdDSA (Ed25519) → Generate → set a Key passphrase → Save private key (a .ppk file). Copy the public key from the top field “Public key for pasting into OpenSSH authorized_keys file” — you’ll need it in the next step.

Step 2. Copy the key to a Linux server

From Linux and macOS — with one command. It asks for the server password one last time and puts the key in the right place:

ssh-copy-id root@YOUR_IP

If SSH runs on a non-standard port: ssh-copy-id -p 2222 root@YOUR_IP.

From Windows there’s no ssh-copy-id, so use this in PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR_IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Manually (for example, with a PuTTYgen key or via the console in your account): log in to the server, open nano ~/.ssh/authorized_keys and paste the public key as a single line. Permissions must be: ~/.ssh folder — 700, file — 600, otherwise the server ignores the key.

Check: ssh root@YOUR_IP should let you in without the server password (it only asks for the key passphrase, if you set one).

Step 2. Copy the key to Windows Server

On Windows Server 2019, 2022 and 2025, first enable the OpenSSH server — in an administrator PowerShell:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

Where the key goes depends on the user:

• Regular user — C:\Users\NAME\.ssh\authorized_keys.
• Member of the Administrators group — the shared file C:\ProgramData\ssh\administrators_authorized_keys. For administrators, the file in the user folder is not read — the most common reason a “key doesn’t work”.

For an administrator, run this on the server (paste your public key inside the quotes):

Add-Content -Path C:\ProgramData\ssh\administrators_authorized_keys -Value "ssh-ed25519 AAAA... ivan@company.uz"
icacls.exe C:\ProgramData\ssh\administrators_authorized_keys /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"

The second command limits access to the file to administrators and the system — with other permissions sshd rejects the key. On a Russian-language Windows the group is called «Администраторы».

Step 3. Disable password login

Only after you’ve confirmed key login works — otherwise you’ll lock yourself out. On Linux, open /etc/ssh/sshd_config and set:

PasswordAuthentication no
PermitRootLogin prohibit-password

On Ubuntu 22.04 and 24.04 also check /etc/ssh/sshd_config.d/ — the 50-cloud-init.conf file may re-enable passwords. Then restart the service and, without closing the current session, test login in a new window:

sudo sshd -t && sudo systemctl restart ssh

On Windows Server it’s the same in C:\ProgramData\ssh\sshd_config: PasswordAuthentication no, then Restart-Service sshd.

A key from one server to another

For rsync backups, deployment or database replication, one server must log in to another without a password. Create a key on server A and copy it to server B:

ssh-keygen -t ed25519 -f ~/.ssh/backup_key -N "" -C "backup@server-a"
ssh-copy-id -i ~/.ssh/backup_key.pub user@SERVER_B
ssh -i ~/.ssh/backup_key user@SERVER_B "hostname"

For such keys, create a separate user with minimal rights on server B — not root. Don’t copy your personal private key to servers: to hop from server to server, use ssh -A or ssh -J (jump host).

Convenience: the ~/.ssh/config file

To avoid typing the IP, port and key path every time, describe your servers in ~/.ssh/config (on Windows — C:\Users\NAME\.ssh\config):

Host prod
    HostName 185.0.0.10
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Now ssh prod is enough, and scp and rsync understand the name too.

If it won’t let you in

• Run ssh -v root@YOUR_IP — the output shows which key is offered and what the server answered.
• Linux: ~/.ssh permissions — 700, authorized_keys — 600, owned by the user. Server errors are in journalctl -u ssh.
• Windows Server: administrator → key in administrators_authorized_keys, permissions via icacls. Log — “Event Viewer → Applications and Services Logs → OpenSSH”.
• The key in authorized_keys must be one line: copying from PuTTYgen or a messenger often adds line breaks.

On a MyCloud VPS you always have a fallback — the server console in your mcvps.uz account: if you make a mistake in SSH settings, you can fix everything from there. A server with Ubuntu, Debian or Windows Server is created on the VPS servers page.