How to Use SSH Keys Instead of Passwords for Network Devices and Servers

Step by step

1. Create a key pair

   Ed25519 keys are short, fast and strong. Protect the private key with a passphrase: it never leaves your laptop.

   ssh-keygen -t ed25519 -C "alice@company-noc"
   # saved to ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public)
   

2. Install the public key

   Copy only the .pub file to the server. On devices without ssh-copy-id, paste the key into the admin page or into ~/.ssh/authorized_keys.

   ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@10.1.10.20
   

3. Test key login

   Open a new terminal and log in. You should be asked for the key passphrase, not the account password.

   ssh -i ~/.ssh/id_ed25519 admin@10.1.10.20
   

4. Turn off password logins

   On Linux hosts and NavEdge edge servers, disable password and root logins in sshd_config, check the syntax and reload.

   sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/; s/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
   sudo sshd -t && sudo systemctl reload ssh
   

5. Use an SSH agent

   Load the key once per session instead of typing the passphrase for every device.

   eval "$(ssh-agent -s)"
   ssh-add ~/.ssh/id_ed25519
   

6. Remove keys when people leave

   Every engineer gets their own key. Delete their line from authorized_keys on every host when they change role or leave.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.