# How to set up SSH keys and disable password login

> Create an ed25519 SSH key on Windows, macOS or Linux, add it to your VPS and turn off password login safely without locking yourself out of the server.

Every server with a public IP gets login attempts from bots within minutes of going online. They try common usernames and passwords all day. An SSH key replaces the password with a pair of files: a **private key** that stays on your computer and a **public key** that you put on the server. Nobody can guess a key, so once key login works you can switch passwords off completely.

This guide assumes you can already log in with the root password from the panel. If not, start with [how to connect via SSH](https://datapasa.com/wiki/server-management/connect-via-ssh).

## Step 1. Create a key on your computer

Use the **ed25519** key type. It is short, fast and supported by every current OpenSSH version.

### macOS and Linux

Open **Terminal** and run:

```bash
ssh-keygen -t ed25519 -C "your-laptop"
```

The `-C` value is only a label that helps you recognize the key later.

### Windows 10 and 11

Windows includes the OpenSSH client. Open **PowerShell** or **Windows Terminal** and run the same command:

```bash
ssh-keygen -t ed25519 -C "your-laptop"
```

### What to answer

1. **File location.** Press Enter to accept the default: `~/.ssh/id_ed25519` on macOS and Linux, `C:\Users\YOU\.ssh\id_ed25519` on Windows.
2. **Passphrase.** Enter one. It encrypts the private key, so a stolen laptop does not mean a stolen server. The SSH agent (built into macOS, and available as the **OpenSSH Authentication Agent** service on Windows) can remember it so you do not type it every time.

Two files appear: `id_ed25519` is the private key and **never leaves your computer**, `id_ed25519.pub` is the public key you can share freely.

> **Already have a key?.** If `~/.ssh/id_ed25519.pub` already exists, reuse it. Do not overwrite a key that other servers or services may rely on.

## Step 2. Add the public key to the server

### macOS and Linux

`ssh-copy-id` appends your public key to `~/.ssh/authorized_keys` on the server and sets the correct permissions:

```bash
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR_SERVER_IP
```

Enter the root password one last time when asked.

### Windows

Windows has no `ssh-copy-id`, so send the key through a normal SSH command in PowerShell:

```bash
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR_SERVER_IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
```

### If you log in as a regular user

If you created a sudo user as described in [securing your VPS](https://datapasa.com/wiki/server-management/secure-vps-ufw-fail2ban), repeat the same step for that user, for example `ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@YOUR_SERVER_IP`.

## Step 3. Test key login

Open a **new** terminal window and connect:

```bash
ssh root@YOUR_SERVER_IP
```

You should get in without the server password. If you set a passphrase, SSH asks for it: that is the key's passphrase, checked locally, not the server password.

To be sure the key was used, connect with verbose output and look for a line saying that authentication succeeded with `publickey`:

```bash
ssh -v root@YOUR_SERVER_IP
```

Do not continue until this works.

## Step 4. Disable password login

Stay in the session that already works. On the server, OpenSSH reads extra settings from `/etc/ssh/sshd_config.d/`. For each option the **first** value it finds wins, and on Ubuntu and Debian the `Include` line for that folder sits at the top of `/etc/ssh/sshd_config`, so those files are read before the rest of the main config. Some images ship a file like `50-cloud-init.conf` that turns passwords back on, so look first:

```bash
grep -ri passwordauthentication /etc/ssh/sshd_config /etc/ssh/sshd_config.d/
```

Create a file whose name sorts before the others so your settings take priority:

```bash
nano /etc/ssh/sshd_config.d/00-hardening.conf
```

Add:

```ini
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
```

`PermitRootLogin prohibit-password` still allows root to log in with a key but never with a password. If you log in only as a sudo user, you can use `PermitRootLogin no` instead.

Check the syntax and the values the SSH server will actually use:

```bash
sshd -t
sshd -T | grep -Ei "passwordauthentication|kbdinteractiveauthentication|permitrootlogin"
```

`sshd -t` prints nothing when the config is valid. The second command must show `passwordauthentication no`. Then apply the change. The service is called `ssh` on Ubuntu and Debian and `sshd` on AlmaLinux, Rocky Linux and CentOS:

```bash
systemctl restart ssh || systemctl restart sshd
```

> **Keep your current session open.** Test from a new window that key login still works and that a password login is refused, for example with `ssh -o PubkeyAuthentication=no root@YOUR_SERVER_IP`. It should fail with `Permission denied (publickey)`. Close the old session only after that.

## If you get locked out

Password login is off and your key is lost or broken? Use the browser console in [VMmanager](https://datapasa.com/wiki/server-management/manage-server-in-vmmanager). The console is like a physical screen and keyboard attached to the VPS, it does not go through SSH. Log in there with the root password, then fix `~/.ssh/authorized_keys` or remove your `00-hardening.conf` file and restart SSH.

## Using several keys and servers

Once you have more than one server, a config file on your computer saves typing. Create or edit `~/.ssh/config`:

```ini
Host datapasa-web
    HostName YOUR_SERVER_IP
    User root
    IdentityFile ~/.ssh/id_ed25519
```

Now `ssh datapasa-web` is enough.

## Summary

You created an ed25519 key, added it to the server, confirmed that it works and turned off password authentication with a drop-in file that cannot be overridden by image defaults. Next, add a firewall and brute force protection with [UFW and fail2ban](https://datapasa.com/wiki/server-management/secure-vps-ufw-fail2ban).