SSH keys instead of passwords - do it right once

Generate one key pair and stop typing passwords to that server.

Password auth scales badly. It is slow for you, weak against reuse, and easy to break by copying the wrong permissions into ~/.ssh.

Generate an Ed25519 key, inspect the fingerprint, then lock down the directory and authorized_keys file.

tmp=$(mktemp -d); cd "$tmp" && ssh-keygen -t ed25519 -a 100 -C 'ops@example.test' -f id_ed25519 -N '' </dev/null
ssh-keygen -lf id_ed25519.pub                                     # print the fingerprint you should trust later

tmp=$(mktemp -d)
install -d -m 700 "$tmp/.ssh"                                   # directory must not be world-readable
install -m 600 /dev/null "$tmp/.ssh/authorized_keys"            # file must be owner-read/write only
stat -c '%n %a' "$tmp/.ssh" "$tmp/.ssh/authorized_keys"

256 SHA256:5dfA9JXIfproQi1EYz76dOFkCRJD46MtI7LpJTQXJg0 ops@example.test (ED25519)

public-key:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMILGitzrlc0FvIsHsSem4Q4xBRkoQDYYZH5/Sc2zGYx ops@example.test

private-perms:600
public-perms:644
/var/folders/0r/gx6m118s7jd2w3r9_4y32dhw0000gn/T/opencode/ssh-demo/.ssh 700
/var/folders/0r/gx6m118s7jd2w3r9_4y32dhw0000gn/T/opencode/ssh-demo/.ssh/authorized_keys 600

That is the whole shape: private key, public key, 700 on the directory, 600 on authorized_keys. Most SSH key problems reduce to one of those four lines.

Generate the key before the next server asks for a password.