Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I want to be able to login to a remote via ssh without having to enter the password all the time.

  • How do I set it up?
  • Is a different command required to execute a password-less session?
share|improve this question
Are you using openssh? (if so that's easy ;) ) –  Rinzwind Jun 4 '11 at 17:29
@Rinzwind, Why would I bother getting the proprietary version when OpenSSH is already preinstalled? –  Oxwivi Jun 4 '11 at 18:18
I try to not make assuptions ;) –  Rinzwind Jun 4 '11 at 18:21
Note that this is considered a poor security practice, and some distributions disable it out of the box. I'm not certain, but it's possible you'll need to enable PermitRootLogin in /etc/ssh/sshd_config in order to make this work. –  Kevin Jul 26 at 16:49
@Kevin, please clarify yourself. We're talking about ssh-ing without password, which is generally a good practice. Do you mean ssh-ing into a root shell? That's not covered by this question. –  Oxwivi Jul 29 at 15:37

11 Answers 11

up vote 81 down vote accepted


Execute these two commands:


Then you'll need to copy the new key to your server:

ssh-copy-id user@host
## or if your server uses custom port no:
ssh-copy-id "user@host -p 1234"

After the key is copied, ssh into the machine as normal:

ssh user@host

You can now login without entering a password from the particular machine you executed the commands at.


not-marco@rinzwind-desktop:~$ ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/home/not-marco/.ssh/id_rsa): 
Created directory '/home/not-marco/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/not-marco/.ssh/id_rsa.
Your public key has been saved in /home/not-marco/.ssh/
The key fingerprint is:
b1:25:04:21:1a:38:73:38:3c:e9:e4:5b:81:e9:ac:0f not-marco@rinzwind-desktop
The key's randomart image is:
+--[ RSA 2048]----+
|.o= . oo.        |
|*B.+ . .         |
|*=o .   o .      |
| = .     =       |
|. o     S        |
|E.               |
| o               |
|  .              |
|                 |
not-marco@rinzwind-desktop:~$ ssh-copy-id not-marco@
not-marco@'s password: 
Now try logging into the machine, with "ssh 'not-marco@'", and check in:


to make sure we haven't added extra keys that you weren't expecting.


This assumes you already have successfully connected to your server via SSH.

You'll need to generate an SSH Keypair which will allow you to identify you as yourself without using a password. You can opt to protect keys with a passcode if you wish, but this can be left blank allowing totally password-less SSH access.

First create your SSH Keypair by running ssh-keygen this will create an id_rsa and file. The pub file is what goes on the servers, the private key (id_rsa) is what stays with you and is how you identify yourself.

Next copy the public key to your server with ssh-copy-id user@server replacing user with your remote user and server with the machine DNS name or IP address. It'll prompt for your SSH password, enter it and if all completes successfully you'll be able to access the machine via ssh user@server without needing a password.


share|improve this answer
kyentei's answer seems far simpler. –  Oxwivi Jun 4 '11 at 18:34
@Oxwivi this answer is the more correct way to do it - but it seems longer. All you need to do is type ssh-keygen follow the on-screen instructions, then type ssh-copy-id user@server replacing user with your remote user and server with the remote machine –  Marco Ceppi Jun 4 '11 at 18:36
I had this error "Agent admitted failure to sign using the key." every time when trying to login after following this procedure. The solution was to run "> ssh-add" on the local machine and now I can log to the remote machine as expected. –  jmbouffard Jul 5 '11 at 15:23
Best thing about your answer is that you give good explanations :) I lost an hour trying to do it the other way - generating the keys o the server machine, not the client. Though probably it is obvious how/where to do it, it is not when you do it for the first time. Thank you ! –  deckoff Mar 6 '12 at 19:28
It's worth to mention that if you need to use custom port for @server, you need to do this with: ssh-copy-id "not-marco@ -p 1234". –  s3m3n Apr 19 '13 at 13:36

Type the following commands:

  1. ssh-keygen

    Press Enter key till you get the prompt

  2. ssh-copy-id -i root@ip_address

    (It will once ask for the password of the host system)

  3. ssh root@ip_address

Now you should be able to login without any password.

share|improve this answer

I normally use sshpass for that, install it with sudo apt-get install sshpass and use it like this

sshpass -p 'password' ssh your_username@your_server
share|improve this answer
Why not to use ssh keys? –  enzotib Dec 6 '11 at 17:39
Its not a "why not" situation, it still works perfect without adding keys, its just another method I would say. –  Bruno Pereira Dec 6 '11 at 18:05
Thanks for the information on sshpass, never heard of it before. –  bodhi.zazen Dec 6 '11 at 18:39
SSH keys are the "correct" answer to the question, but sshpass is a very useful hack in cases when you can't change the authentication method on the remote server! –  Jacob Krall Mar 14 '14 at 15:27
This is very dangerous, you'll keep in bash_history or whatever the plain passwords for the hosts you're connecting to.. –  kappa Jul 22 at 12:48

The way I usually do this is as follows:

ssh-keygen -t rsa

(When prompted for a password, leave it blank)

Then: cat ~/.ssh/ | ssh username@hostname 'cat >> .ssh/authorized_keys'

(This requires the folder .ssh to be in the home directory on the targeted hostname, with the authorized_keys file in it)

Of course, replace username with the desired username, and hostname with the desired hostname or IP address

After that, just SSH to that box just like you're used to.

share|improve this answer
What about the touch and chmod command in Rinzwind's answer? –  Oxwivi Jun 4 '11 at 18:29
You'll need to chmod the .ssh/authorized_keys file to 0600 or this will not work –  Marco Ceppi Jun 4 '11 at 18:36

If you create a public/pricate keypair und log in using the public key method you will not need to type your password. That is depending on the configuration of your key-ring and ssh agent.

Here is one of many short howtos for you. It is of crucial importance to the safety of this method, that the thusly generated private key remains private!

share|improve this answer

Remote login/copy without giving a password

The applications ssh and scp for remote login and remote copy, respectively, allow you to communicate with a remote host without giving a password. This requires that you follow an authentication procedure like the one described below. By client we mean the machine your are sitting on and by server we mean the machine you want to log onto without giving a password. The steps of the authentication procedure are:

  1. Run ssh-keygen to generate private and public keys, unless this is already done on your machine. These are stored in files in $HOME/.ssh.
  2. Append the contents of the public key file to the file $HOME/.ssh/authorized_keys or $HOME/.ssh/authorized_keys2 on the server.

There are three different types of authentication protocols. You specify the type when running ssh-keygen:

  1. SSH protocol version 1, RSA1: this is the default choice and results in files identity (private key, should take chmod 0700 to ensure that this file is not readable for others) and (public key).
  2. SSH protocol version 1, RSA: this is obtained by running ssh-keygen -t rsa and results in files id_rsa (private key) and (public key)
  3. SSH protocol version 1, DSA: this is obtained by running ssh-keygen -t dsa and results in files id_dsa (private key) and (public key)

When running ssh-keygen you can rely on default answers (implying that you do not give a passphrase). This makes the whole set-up simple, but also insecure.

You can specify the type of keys to be used by an option to ssh; ssh -1 forces use of RSA1 keys (protocol version 1), whereas ssh -2 forces ssh to try RSA or DSA keys only (protocol version 2). In the examples below, we generate and install RSA1 and DSA keys on the remote host such that you have more flexibility. You can make a config file in your .ssh directory with the line

Protocol 1,2

This makes ssh try an RSA1 (protocol version 1) connection before RSA/DSA (protocol version 2).

Using RSA1 keys

remote=user@remotehost   # fill in correct user and remotehost names
cd $HOME/.ssh
# create .ssh on remote host if it is non-existing:
ssh $remote 'if [ ! -d .ssh ]; then mkdir .ssh; fi' 
# copy RSA1 key: 
scp ${remote}:.ssh
ssh $remote "cd .ssh; cat >> authorized_keys"

Using DSA keys

remote=user@remotehost   # fill in correct user and remotehost names
cd $HOME/.ssh
# create .ssh on remote host if it is non-existing:
ssh $remote 'if [ ! -d .ssh ]; then mkdir .ssh; fi' 
# copy DSA key: 
scp ${remote}:.ssh
ssh $remote "cd .ssh; cat >> authorized_keys2"

This is all you have to do if you did not use a passphrase when generating the keys. You can test the connection by running ssh $remote and see if you can log in without giving a password (you may need to use -1 or -2 as options to ssh). The procedure can, of course, be repeated for any machine you want to log onto.

If you did use a passphrase, you will have to run the program ssh-agent to start a special shell, followed by ssh-add to register your key/passphrase combination with sshd. See the man pages for these programs for more information.

A script for automating password-free connections:


# create ssh connections without giving a password

if [ $# -lt 1 ]; then
  echo Usage: $0 username@remotehost
remote="$1"  # 1st command-line argument is the user@remotehost address
this=$HOST   # name of client host

# first check if we need to run ssh-keygen for generating
# $HOME/.ssh with public and private keys:
if [ ! -d $HOME/.ssh ]; then
  echo "just type RETURN for each question:" # no passphrase - unsecure!!
  # generate RSA1, RSA and DSA keys:
  echo; echo; echo
  echo; echo; echo
  ssh-keygen -t rsa
  echo; echo; echo
  ssh-keygen -t dsa
  # we have $HOME/.ssh, but check that we have all types of
  # keys (RSA1, RSA, DSA):
  if [ ! -f $HOME/.ssh/identity ]; then
     # generate RSA1 keys:
     echo "just type RETURN for each question:" # no passphrase - unsecure!!
  if [ ! -f $HOME/.ssh/id_rsa ]; then
     # generate RSA keys:
     echo "just type RETURN for each question:" # no passphrase - unsecure!!
     ssh-keygen -t rsa
  if [ ! -f $HOME/.ssh/id_rsa ]; then
     # generate DSA keys:
     echo "just type RETURN for each question:" # no passphrase - unsecure!!
     ssh-keygen -t dsa

cd $HOME/.ssh

if [ ! -f config ]; then
  # make ssh try ssh -1 (RSA1 keys) first and then ssh -2 (DSA keys)
  echo "Protocol 1,2" > config

# copy public keys (all three types) to the destination host:

echo; echo; echo
# create .ssh on remote host if it's not there:
ssh $remote 'if [ ! -d .ssh ]; then mkdir .ssh; fi' 
# copy RSA1 key: 
scp ${remote}:.ssh/${this}
# copy RSA key:
#scp ${remote}:.ssh/${this}
# copy DSA key:
scp ${remote}:.ssh/${this}
# make authorized_keys(2) files on remote host:

echo; echo; echo
# this one copies all three keys:
#ssh $remote "cd .ssh; touch authorized_keys authorized_keys2; cat ${this} >> authorized_keys; cat ${this} >> authorized_keys2; cat ${this} >> authorized_keys2;"
# this one copies RSA1 and DSA keys:
ssh $remote "cd .ssh; touch authorized_keys authorized_keys2; cat ${this} >> authorized_keys; cat ${this} >> authorized_keys2;"

echo; echo; echo
echo "try an ssh $remote"

copied from:

share|improve this answer

Disable Password Authentication

Because a lot of people with SSH servers use weak passwords, many online attackers will look for an SSH server, then start guessing passwords at random. An attacker can try thousands of passwords in an hour, and guess even the strongest password given enough time. The recommended solution is to use SSH keys instead of passwords. To be as hard to guess as a normal SSH key, a password would have to contain 634 random letters and numbers. If you'll always be able to log in to your computer with an SSH key, you should disable password authentication altogether.

If you disable password authentication, it will only be possible to connect from computers you have specifically approved. This massively improves your security, but makes it impossible for you to connect to your own computer from a friend's PC without pre-approving the PC, or from your own laptop when you accidentally delete your key.

It's recommended to disable password authentication unless you have a specific reason not to.

To disable password authentication, look for the following line in your sshd_config file:

PasswordAuthentication yes

replace it with a line that looks like this:

PasswordAuthentication no

Once you have saved the file and restarted your SSH server, you shouldn't even be asked for a password when you log in.

share|improve this answer
ssh-copy-id userId@host
share|improve this answer
Please elaborate on what should be done here - headlines alonne are not really helpful. –  guntbert May 31 '13 at 21:48

To make some additions:

  • Mac by default doesn't have ssh-copy-id, you'll have to install it youself:

    curl -o /usr/local/bin/ssh-copy-id
    chmod +x /usr/local/bin/ssh-copy-id

find more here:

  • if you've made a port-forwarding, the command should be like this:

    ssh-copy-id "not-marco@ -p 2222"

note that the quotes are necessary.

share|improve this answer

Following article explains in clear and concise way. I use it myself for a quick reference.

To answer your second question. Once the password-less ssh setup is done. You just need to use exactly the same commands as before.

share|improve this answer
Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Eric Carvalho Nov 7 '13 at 10:51

How do I set it up?

Please see the below article to setup the SSH keys very easily.

Is a different command required to execute a password-less session?

Use the same commands as before.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.