How To Configure SSH Key-Based Authentication on a FreeBSD Server

1.In your local computer's terminal, generate a key pair with this command.

$ ssh-keygen -t rsa -C "user@server" -b 4096 -f ~/.ssh/filename

2.Copy the public key to your server.

$ ssh-copy-id -i ~/.ssh/filename[.pub] user@server

If ssh-copy-id is not available on your machine , you will need to do this by hand.
Copy the contents of filename.pub to ~/.ssh/authorized_keys

$ cat .ssh/id_rsa.pub | ssh user@server 'cat >> .ssh/authorized_keys'
$ ssh user@server "chmod 700 .ssh; chmod 640 .ssh/authorized_keys"

[OR]

$ scp ~/.ssh/id_rsa.pub user@server:~
$ mkdir -p ~/.ssh 
$ touch ~/.ssh/authorized_keys
$ cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
$ rm ~/id_rsa.pub
$ chmod 600 ~/.ssh/authorized_keys
$ chmod 700 ~/.ssh

3.In your server, To confirm the public key has been copied.

$ cat ~/.ssh/authorized_keys

4.Backup the /etc/ssh/sshd_config file.

$ cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

5.Edit the /etc/ssh/sshd_config file.

Protocol configuration.

#Protocol 2  

>>>

Protocol 2  

HostKeys for protocol version 2 configuration.

#HostKey /etc/ssh/ssh_host_rsa_key  

>>>

HostKey /etc/ssh/ssh_host_rsa_key  

---

#HostKey /etc/ssh/ssh_host_ecdsa_key 

>>>

 
HostKey /etc/ssh/ssh_host_ecdsa_key  

---

#HostKey /etc/ssh/ssh_host_ed25519_key 

>>>

 
HostKey /etc/ssh/ssh_host_ed25519_key  

---

Don't Uncomment the DSA.

#HostKey /etc/ssh/ssh_host_dsa_key  

because DSA is not considered secure anymore.

Logging configuration.

#SyslogFacility AUTH  

>>>

SyslogFacility AUTH  

---

#LogLevel INFO  

>>>

LogLevel INFO  

---

Authentication configuration.

#PermitRootLogin no  

>>>

PermitRootLogin no  

---

#MaxSessions 10  

>>>

MaxSessions 1  

---

[ssh v1]

#RSAAuthentication yes

>>>

RSAAuthentication yes  

---

[ssh v2]

#PubkeyAuthentication yes

>>>

 
PubkeyAuthentication yes  

---

#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2  

>>>

AuthorizedKeysFile .ssh/authorized_keys

---

#PasswordAuthentication no  

>>>

PasswordAuthentication no  

---

#PermitEmptyPasswords no  

>>>

PermitEmptyPasswords no  

---

#ChallengeResponseAuthentication yes  

>>>

ChallengeResponseAuthentication no