Using SSH Key with Windows System: Headless Ubuntu Server via scp

To securely transfer files between a Windows client and a headless Ubuntu server, you must configure SSH key authentication to eliminate password prompts during scp operations. This process involves generating an RSA or Ed25519 key pair on Windows using tools like OpenSSH or PuTTY, then copying the public key to the Ubuntu server's .ssh/authorized_keys file. Once configured, you can execute standard scp commands without manual intervention, ensuring automated and secure data synchronization for server management tasks.

Generating SSH Keys on Windows

The foundation of password-less authentication lies in the cryptographic key pair stored on your Windows machine. Modern versions of Windows 10 and 11 include the OpenSSH client by default, which simplifies this step significantly compared to older methods requiring third-party software. You should open PowerShell or Command Prompt as an administrator to ensure proper access to system directories, although standard user privileges are often sufficient for generating keys in the user profile folder. Run the following command to generate a new key pair. We recommend using the Ed25519 algorithm for its superior security and performance, though RSA remains widely compatible if your server has legacy constraints.

ssh-keygen -t ed25519 -C "[email protected]"

When prompted for a file location, press Enter to accept the default path (C:\Users\YourUsername\.ssh\id_ed25519). For enhanced security, you may choose to set a passphrase, but this will require entering it each time unless you use an SSH agent. If you prefer not to use a passphrase for fully automated scripts, simply press Enter twice when asked. The command outputs two files: the private key (which stays on Windows) and the public key (which goes to the server). Note that the public key file ends with .pub. If you are using an older version of Windows or a specific environment that lacks native OpenSSH, you might rely on PuTTYgen. In this case, generate the key in PuTTYgen and save both the private key (as a .ppk file) and the public key in OpenSSH format. However, migrating to native OpenSSH is strongly advised for consistency across Linux and Windows environments.

Transferring the Public Key to Ubuntu

The next critical step is placing your Windows public key into the correct directory on the headless Ubuntu server. Since the server is headless, you cannot use graphical interfaces; you must use command-line tools. The standard method is to use ssh-copy-id, which automates the appending of the key to the remote user's authorized keys file. Execute the following command from your Windows terminal, replacing username with your actual Ubuntu login name and server_ip with the server's IP address or hostname.

ssh-copy-id username@server_ip

This command attempts to log in using your existing password one last time to verify identity. Upon successful authentication, it creates the .ssh directory in the home folder if it does not exist, sets the correct permissions, and appends your public key to ~/.ssh/authorized_keys. If ssh-copy-id is unavailable due to a custom setup or restricted shell, you can manually copy the content of your .pub file and append it to the remote file using cat and >>:

cat ~/.ssh/id_ed25519.pub | ssh username@server_ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

After running this, verify that the key was added correctly by checking the contents of ~/.ssh/authorized_keys on the server via an SSH session. Ensure that the .ssh directory has permissions set to 700 and the authorized_keys file has permissions set to 600. Incorrect permissions are a common cause of authentication failures.

Configuring SSH for Seamless SCP Usage

With the key installed, you need to ensure that the SSH client on Windows prioritizes key-based authentication over password authentication. By default, SSH tries multiple authentication methods. To streamline this, you can create or edit the config file located at C:\Users\YourUsername\.ssh\config. Add the following entries to specify the key to use and disable password prompts for specific hosts.

Host server_alias
    HostName server_ip
    User username
    IdentityFile ~/.ssh/id_ed25519
    PubkeyAuthentication yes
    PasswordAuthentication no

Replace server_alias with a nickname for easy reference. This configuration tells the SSH client to always use the specified private key for connections to that host and to skip password challenges entirely. This prevents delays caused by failed password attempts and ensures that scp commands proceed immediately. You can test the connection by running ssh server_alias. If configured correctly, you should be logged in without any password prompt. Once verified, you can perform file transfers using scp. For example, to upload a file:

scp C:\path\to\localfile.txt server_alias:/remote/path/

And to download a file:

scp server_alias:/remote/path/remotefile.txt C:\path\to\destination\

For more complex network issues, such as connectivity errors, refer to Persistent SSH Error 'port 22: No route to host'. If you encounter issues with file dialogue windows in SSH sessions, see How to Open File Dialogue Window in SSH for Windows, PowerShell, and Ubuntu 20.04.

Troubleshooting Common Issues

Despite correct configuration, several factors can prevent key-based authentication from working. First, check the ownership and permissions on the server. The .ssh directory must be owned by the user, and group/world write permissions must be removed. Run chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys on the Ubuntu server. Second, ensure that the SSH daemon on Ubuntu is configured to allow public key authentication. Edit /etc/ssh/sshd_config and verify that PubkeyAuthentication yes is present and uncommented. Restart the SSH service with sudo systemctl restart sshd after making changes. Third, verify that the key type is supported. While Ed25519 and RSA are standard, some very old servers may require DSA or ECDSA, which are generally discouraged due to security weaknesses. If you suspect a protocol mismatch, check the SSH logs on the server at /var/log/auth.log for detailed error messages indicating why the authentication failed. Finally, if you are using a proxy or jump host, ensure that the IdentityFile path in your config is relative to the correct context. Sometimes, nested SSH sessions require forwarding the authentication agent using -A flag or configuring ForwardAgent yes in the local config.

Frequently Asked Questions

Why does scp still ask for a password even after adding the key?

This usually indicates incorrect file permissions on the server. Ensure that the .ssh directory is 700 and authorized_keys is 600. Also, verify that the key ownership matches the user account attempting the login.

Can I use the same SSH key for multiple Ubuntu servers?

Yes, you can copy the same public key to the authorized_keys file of multiple users or servers. This allows a single Windows machine to authenticate seamlessly across different systems without generating new keys for each.

What happens if my SSH private key is lost or stolen?

If the private key is compromised, anyone with it can access the associated servers. You must immediately remove the corresponding public key from all authorized_keys files on the servers. Then, generate a new key pair and distribute the new public key.

How do I handle SCP transfers through a firewall or NAT?

Ensure that port 22 is open on the Ubuntu server's firewall (e.g., UFW or iptables). If behind NAT, port forwarding must be configured on the router to direct incoming SSH traffic to the server's internal IP address. Check connectivity using telnet server_ip 22 from Windows.

Is it safe to store SSH keys without a passphrase?

Storing keys without a passphrase is convenient for automation but less secure. If the Windows machine is compromised, attackers can use the key directly. For better security, use a passphrase and an SSH agent, or restrict the key's usage with command restrictions in authorized_keys.