How to Copy SSH Keys to a Remote Server (ssh-copy-id)

In this tutorial, you'll learn about How to Copy SSH Keys to a Remote Server (ssh. We cover key concepts, practical examples, and best practices.

The Problem

You keep typing your password every time you SSH into a server. Password-based SSH is slow, insecure, and does not work with automated tools like rsync, git, or Ansible that require non-interactive authentication.

Quick Fix

Step 1: Generate an SSH key pair if you do not have one

Check for existing keys:

ls -la ~/.ssh/id_*.pub

If no keys exist, generate a new pair:

ssh-keygen -t ed25519 -C "your_email@example.com"

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/user/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Your identification has been saved in /home/user/.ssh/id_ed25519
Your public key has been saved in /home/user/.ssh/id_ed25519.pub

Step 2: Copy the public key to the remote server

Use ssh-copy-id to install your key:

ssh-copy-id user@192.168.1.100

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/user/.ssh/id_ed25519.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s)
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed
user@192.168.1.100's password:
Number of key(s) added: 1

Step 3: Test passwordless login

SSH without being prompted for a password:

ssh user@192.168.1.100

If you set a passphrase, you are prompted for that instead of the account password.

Step 4: Manually copy the key (if ssh-copy-id is not available)

If ssh-copy-id is not installed on your system:

cat ~/.ssh/id_ed25519.pub | ssh user@192.168.1.100 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Step 5: Specify a different port or key

If the remote SSH server uses a non-default port:

ssh-copy-id -p 2222 user@192.168.1.100

To use a specific key file:

ssh-copy-id -i ~/.ssh/project_key.pub user@192.168.1.100

Alternative Solutions

Use ssh-copy-id with a jump host

Copy keys through an intermediate server:

ssh-copy-id -J user@jumphost user@target

Use ssh-agent for key forwarding

Forward your key instead of copying it:

ssh -A user@server

Common Mistakes to Avoid

Copying the private key instead of the public key. Never copy id_ed25519 (private). Only copy id_ed25519.pub (public).

Setting incorrect permissions on ~/.ssh/authorized_keys. The file must be 600 and the directory 700. ssh-copy-id handles this automatically.

Using password authentication after setting up keys. If key auth fails, SSH falls back to password. Disable PasswordAuthentication no in sshd_config for security.

Pro Tips

Use ssh-keygen with different key types for different hosts. Generate separate keys for GitHub, GitLab, and internal servers, and use ~/.ssh/config to match them.

Use ssh-agent for passphrase caching. Add your key to the agent: ssh-add ~/.ssh/id_ed25519 and you only enter the passphrase once per session.

Use ProxyJump for bastion hosts. Configure jump hosts in ~/.ssh/config: Host internal HostName 10.0.0.1 ProxyJump bastion.example.com.

Prevention

• Use ssh-copy-id instead of manually editing authorized_keys to avoid permission errors.
• Set PasswordAuthentication no in /etc/ssh/sshd_config after deploying keys for improved security.
• Use ed25519 keys instead of RSA for better security and performance.