Set Up SSH Key Authentication

SSH keys replace passwords with a cryptographic pair: a private key that never leaves your computer and a public key you place on the server. Logins become both easier (no typing) and far stronger (nothing to guess or phish). This guide sets up keys for a Linux VPS, then turns password logins off without locking you out.

1. Generate a key pair#

On your own computer, not the server. macOS, Linux, and Windows 10 or 11 all include ssh-keygen:

ssh-keygen -t ed25519 -C "alex@laptop"

Accept the default file location and set a passphrase. The passphrase encrypts the private key on disk, so a stolen laptop does not become a stolen server. Ed25519 is the modern default; use -t rsa -b 4096 only if you must talk to something ancient.

You now have two files, typically ~/.ssh/id_ed25519 (private, keep secret) and ~/.ssh/id_ed25519.pub (public, safe to share). On Windows they live in C:\Users\you\.ssh\.

2. Install the public key on the server#

If you can already log in with a password, ssh-copy-id does the whole job:

ssh-copy-id [email protected]

Without ssh-copy-id (Windows PowerShell, for example), append the key by hand. Log in with your password and run, replacing the key text with the one line from your .pub file:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-ed25519 AAAA...your key... alex@laptop" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Doing this for root as well as your own user is fine; keys are per-account.

3. Test the key login#

Open a new terminal, keep the old one connected, and log in:

ssh [email protected]

You should be asked for your key passphrase (or nothing, if your agent has it cached) and land at a prompt without a password. Do not continue until this works.

4. Disable password logins#

With the key confirmed, edit the SSH server config on the VPS:

sudo nano /etc/ssh/sshd_config

Set these values (uncomment them if needed):

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password
KbdInteractiveAuthentication no

On Ubuntu, also check /etc/ssh/sshd_config.d/ for a cloud-init file that re-enables passwords, and set it to no there too. Then reload:

sudo sshd -t && sudo systemctl reload ssh     # Ubuntu / Debian
sudo sshd -t && sudo systemctl reload sshd    # AlmaLinux / Rocky

Test once more from a new terminal. Password prompts should be gone; key logins should still work.

Handy extras#

• Preinstall on reinstall: store the same public key on your account in the cloud portal and select it when you reinstall, so a fresh image comes up key-only from the first boot. See Store SSH Keys in the Cloud Portal.
• Agent caching: ssh-add ~/.ssh/id_ed25519 stores the unlocked key in your session so you type the passphrase once. On macOS add UseKeychain yes to ~/.ssh/config.
• Host aliases: in ~/.ssh/config, a block like Host web1 / HostName 203.0.113.10 / User alex lets you type ssh web1.
• Multiple devices: generate a separate key on each computer and add every public key to authorized_keys. Remove a line to revoke a lost device.
• PuTTY users: generate with PuTTYgen, paste the OpenSSH-format public key into authorized_keys, and point PuTTY at the .ppk file under Connection, SSH, Auth.

Next#

Keys are one leg of the stool. Add a firewall and finish the rest of First Steps on a New Linux Server.