Synology DS916+] How to Set Up SSH Key-Based Login from Windows 11 to Synology NAS (DSM 7.1)

This step-by-step guide explains how to generate an SSH key on Windows 11 using Git Bash and configure key-based authentication on Synology NAS running DSM 7.1. This lets you securely log in without typing a password every time.

Although clients like SecureCRT offer features to remember your password after one login, setting up SSH key authentication is a more secure and reliable method—especially for automation, scripting, or accessing your NAS from multiple devices.

Step 1: Enable User Home Service on DSM 7.1

1. Go to: Control Panel → User & Group → Advanced
2. Enable User Home Service

Step 2: Enable SSH Service on DSM 7.1

1. Navigate to: Control Panel → Terminal & SNMP → Terminal
2. Enable SSH service
3. Make sure Port 22 is allowed in your NAS firewall settings

Step 3: Set Permissions for .ssh Directory

C:\Users\jason>ssh -p 22 abc.i234.me
jason@abc.i234.me's password:

Synology strongly advises you not to run commands as the root user, who has
the highest privileges on the system. Doing so may cause major damages
to the system. Please note that if you choose to proceed, all consequences are
at your own risk.

jason@abc:~$

jason@abc:~$ sudo -i
Password: 
root@abc:~#

root@abc:~# mkdir -p /var/services/homes/jason/.ssh
root@abc:~# chmod 700 /var/services/homes/jason/.ssh
root@abc:~# chmod 600 /var/services/homes/jason/.ssh/authorized_keys
root@abc:~# chown -R jason:users /var/services/homes/jason/.ssh

Step 4: Generate SSH Key on Windows 11 with Git Bash

Press Enter to accept the default file location:

/c/Users/jason/.ssh/id_rsa

Optionally, enter a passphrase for enhanced security.

jason@DESKTOP-7PIMA5B MINGW64 ~
$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/c/Users/jason/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /c/Users/jason/.ssh/id_rsa
Your public key has been saved in /c/Users/jason/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:eDBgu+vjX13KlHE2CMP+rLPsbrETNs0BMUBxLvs5pXU jason@DESKTOP-4QE5MBF
The key's randomart image is:
+---[RSA 3072]----+
|    o.++*.       |
|   . o oo+ .     |
|    . +...o +    |
|     . *. .= .   |
|    . o S==.E    |
|     . o=O=+     |
|    .  .**+      |
|   ..  o*.       |
|   .oo.+=+       |
+----[SHA256]-----+

Generated files:

• Private key: /c/Users/jason/.ssh/id_rsa
• Public key: /c/Users/jason/.ssh/id_rsa.pub

Step 5: Copy Public Key to Synology NAS

jason@DESKTOP-7PIMA5B MINGW64 ~
$ cd .ssh

jason@DESKTOP-7PIMA5B MINGW64 ~/.ssh
$ ll
total 12
-rw-r--r-- 1 jason 197121 3381 Sep 19  2022 id_rsa
-rw-r--r-- 1 jason 197121  743 Sep 19  2022 id_rsa.pub
-rw-r--r-- 1 jason 197121 2270 Apr 23 10:37 known_hosts

jason@DESKTOP-7PIMA5B MINGW64 ~/.ssh
$ ssh-copy-id -i id_rsa.pub -p 22 jason@abc.i234.me
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s),
                            to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed
                            -- if you are prompted now it is to install the new keys

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh -p '22' 'jason@example.i234.me'"
and check to make sure that only the key(s) you wanted were added.

jason@DESKTOP-7PIMA5B MINGW64 ~

Step 6: Update OpenSSH Server Configuration

root@digdeep:~# vi /etc/ssh/sshd_config

Ensure these lines are present and uncommented:

PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

Step 7: Restart SSH Service

root@digdeep:~# synoservicectl --restart sshd

Step 8: Test: Login Without Password

jason@DESKTOP-7PIMA5B MINGW64 ~
$ ssh -p 22 jason@abc.i234.me

If everything is correctly set up, you won’t be asked for a password.