SSH keys provide a secure alternative to password authentication for connecting to remote servers. This guide covers generating SSH key pairs using PuTTYgen and configuring key-based authentication on Windows.

Downloading PuTTYgen

PuTTYgen is a key generation tool bundled with the PuTTY SSH client. Download the PuTTY installer from the official PuTTY download page and run the installation wizard. PuTTYgen will be available after installation completes.

Generating an SSH Key Pair

Launch PuTTYgen from the Windows Start menu under PuTTY (64-bit) → PuTTYgen, or double-click the executable file directly.

In the key generation window, configure the following options:

• Type of key to generate: Keep the default RSA selection
• Number of bits in a generated key: 2048 bits is sufficient for most use cases; 4096 bits provides enhanced security

Click the Generate button. The tool will prompt you to move your mouse randomly over the blank area beneath the progress bar to generate cryptographic randomness. Continue moving the cursor until the progress bar fills completely.

Once generation finishes, the public key appears in the text field. At this point, you can:

1. Enter a passphrase in the "Key passphrase" field for additional security, then confirm it in the "Confirm passphrase" field
2. Click Save public key to store the public portion
3. Click Save private key to store the private portion in PPK format

Save both keys to a secure location. The private key uses the .ppk extension and should remain confidential. The public key can be shared freely with server administrators.

Transferring the Public Key to a Linux Server

Connect to your target Linux server using an existing PuTTY session. Create the .ssh directory and set appropriate permissions:

mkdir -p ~/.ssh
chmod 0700 ~/.ssh

Open or create the ~/.ssh/authorized_keys file:

nano ~/.ssh/authorized_keys

Copy the public key text from PuTTYgen (displayed under "Public key for pasting into OpenSSH authorized_keys file") and paste it into the file. The entire key must appear on a single line with no line breaks.

Set the correct file permissions:

chmod 0600 ~/.ssh/authorized_keys

Authenticating with the SSH Key

Pageant serves as PuTTY's authentication agent, holding private keys in memory for the session duration. Access it via Windows Start menu → PuTTY (64-bit) → Pageant.

The Pageant icon appears in the system tray. Double-click to open the main window, then click Add Key. Navigate to your private key file and select it. If you assigned a passsphrase during key generation, enter it when prompted.

After loading the key, open a new PuTTY session to your server. The connection should authenticate automatically without prompting for a password.

Hardening SSH Security

Once key-based authentication functions correctly, you can disable password authentication to prevent brute-force attacks.

Edit the SSH daemon configuration on the remote server:

sudo nano /etc/ssh/sshd_config

Locate and modify these directives:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

Restart the SSH service to apply changes:

sudo systemctl restart ssh

The server now accepts only key-based authentication. Before completing this step, verify that you're SSH key authentication works reliably and that you have sudo access on the server.