Appearance

How to set up SSH keys and disable password login ​

Every server with a public IP gets login attempts from bots within minutes of going online. They try common usernames and passwords all day. An SSH key replaces the password with a pair of files: a private key that stays on your computer and a public key that you put on the server. Nobody can guess a key, so once key login works you can switch passwords off completely.

This guide assumes you can already log in with the root password from the panel. If not, start with how to connect via SSH.

Step 1. Create a key on your computer ​

Use the ed25519 key type. It is short, fast and supported by every current OpenSSH version.

macOS and Linux ​

Open Terminal and run:

bash
ssh-keygen -t ed25519 -C "your-laptop"

The -C value is only a label that helps you recognize the key later.

Windows 10 and 11 ​

Windows includes the OpenSSH client. Open PowerShell or Windows Terminal and run the same command:

bash
ssh-keygen -t ed25519 -C "your-laptop"

What to answer ​

  1. File location. Press Enter to accept the default: ~/.ssh/id_ed25519 on macOS and Linux, C:\Users\YOU\.ssh\id_ed25519 on Windows.
  2. Passphrase. Enter one. It encrypts the private key, so a stolen laptop does not mean a stolen server. The SSH agent (built into macOS, and available as the OpenSSH Authentication Agent service on Windows) can remember it so you do not type it every time.

Two files appear: id_ed25519 is the private key and never leaves your computer, id_ed25519.pub is the public key you can share freely.

Already have a key?

If ~/.ssh/id_ed25519.pub already exists, reuse it. Do not overwrite a key that other servers or services may rely on.

Step 2. Add the public key to the server ​

macOS and Linux ​

ssh-copy-id appends your public key to ~/.ssh/authorized_keys on the server and sets the correct permissions:

bash
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR_SERVER_IP

Enter the root password one last time when asked.

Windows ​

Windows has no ssh-copy-id, so send the key through a normal SSH command in PowerShell:

bash
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR_SERVER_IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

If you log in as a regular user ​

If you created a sudo user as described in securing your VPS, repeat the same step for that user, for example ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@YOUR_SERVER_IP.

Step 3. Test key login ​

Open a new terminal window and connect:

bash
ssh root@YOUR_SERVER_IP

You should get in without the server password. If you set a passphrase, SSH asks for it: that is the key's passphrase, checked locally, not the server password.

To be sure the key was used, connect with verbose output and look for a line saying that authentication succeeded with publickey:

bash
ssh -v root@YOUR_SERVER_IP

Do not continue until this works.

Step 4. Disable password login ​

Stay in the session that already works. On the server, OpenSSH reads extra settings from /etc/ssh/sshd_config.d/. For each option the first value it finds wins, and on Ubuntu and Debian the Include line for that folder sits at the top of /etc/ssh/sshd_config, so those files are read before the rest of the main config. Some images ship a file like 50-cloud-init.conf that turns passwords back on, so look first:

bash
grep -ri passwordauthentication /etc/ssh/sshd_config /etc/ssh/sshd_config.d/

Create a file whose name sorts before the others so your settings take priority:

bash
nano /etc/ssh/sshd_config.d/00-hardening.conf

Add:

ini
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password

PermitRootLogin prohibit-password still allows root to log in with a key but never with a password. If you log in only as a sudo user, you can use PermitRootLogin no instead.

Check the syntax and the values the SSH server will actually use:

bash
sshd -t
sshd -T | grep -Ei "passwordauthentication|kbdinteractiveauthentication|permitrootlogin"

sshd -t prints nothing when the config is valid. The second command must show passwordauthentication no. Then apply the change. The service is called ssh on Ubuntu and Debian and sshd on AlmaLinux, Rocky Linux and CentOS:

bash
systemctl restart ssh || systemctl restart sshd

Keep your current session open

Test from a new window that key login still works and that a password login is refused, for example with ssh -o PubkeyAuthentication=no root@YOUR_SERVER_IP. It should fail with Permission denied (publickey). Close the old session only after that.

If you get locked out ​

Password login is off and your key is lost or broken? Use the browser console in VMmanager. The console is like a physical screen and keyboard attached to the VPS, it does not go through SSH. Log in there with the root password, then fix ~/.ssh/authorized_keys or remove your 00-hardening.conf file and restart SSH.

Using several keys and servers ​

Once you have more than one server, a config file on your computer saves typing. Create or edit ~/.ssh/config:

ini
Host datapasa-web
    HostName YOUR_SERVER_IP
    User root
    IdentityFile ~/.ssh/id_ed25519

Now ssh datapasa-web is enough.

Summary ​

You created an ed25519 key, added it to the server, confirmed that it works and turned off password authentication with a drop-in file that cannot be overridden by image defaults. Next, add a firewall and brute force protection with UFW and fail2ban.