Replacing passwords with keys, which is both more secure and more convenient.
WHY
Passwords can be guessed. Automated attacks try thousands per hour against every server on the internet. A key cannot realistically be guessed.
GENERATING A KEY PAIR
On your own computer, generate a key pair. You get a private key, which stays on your computer, and a public key, which goes on the server.
Protect the private key with a passphrase. A key without one is a password written on a note.
INSTALLING THE PUBLIC KEY
Copy the public key into the authorized_keys file in your user's .ssh directory on the server. Tools exist to do this in one command.
Set permissions correctly: the .ssh directory to 700 and authorized_keys to 600, or SSH refuses to use them.
TESTING BEFORE DISABLING PASSWORDS
Open a second SSH session using the key and confirm it works, while keeping your first session open. Only then disable password authentication.
If you disable passwords before confirming the key works, you lock yourself out and need console access to recover.
MULTIPLE PEOPLE
Each person gets their own key. Never share a private key.
