Set up SSH key authentication on a Linux VPS

SSH key authentication replaces your server password with a cryptographic key pair: a private key that never leaves your computer and a public key stored on the server. It is far harder to brute-force than a password and lets you log in, run scripts and use tools like rsync without typing a password every time.

Before you start

• A Linux VPS with SSH access as root or a sudo user.
• A terminal: macOS/Linux Terminal, or Windows 10/11 PowerShell (OpenSSH is built in).
• A second SSH session kept open while you change settings, so you can undo mistakes.

Generate an SSH key pair

On your own computer (not the server), run:

ssh-keygen -t ed25519 -C "laptop-2024"

Press Enter to accept the default path (~/.ssh/id_ed25519) and set a passphrase. The passphrase encrypts the private key on disk, so a stolen laptop does not mean a stolen server. If an old system needs RSA, use ssh-keygen -t rsa -b 4096 instead.

You now have two files:

Copy the public key to the server

On macOS and Linux the easiest way is ssh-copy-id:

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@203.0.113.10

On Windows PowerShell, which has no ssh-copy-id, pipe the key over SSH:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@203.0.113.10 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Both methods append the key to ~/.ssh/authorized_keys for that user. One line per key; you can add keys for several computers.

Fix permissions on the server

OpenSSH ignores keys if the folder or file is writable by other users. On the server run:

chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

If you created the files as root for another user, also run chown -R user:user /home/user/.ssh.

Test the key login

Open a new terminal and connect:

ssh -i ~/.ssh/id_ed25519 root@203.0.113.10

You should be asked only for the key passphrase (or nothing, if an SSH agent has it loaded), not the server password. Add -v to see which key is offered if it fails.

Disable password logins

Only after the key login works, edit the SSH server config:

nano /etc/ssh/sshd_config

Set these values (uncomment them if needed). On newer Ubuntu releases also check files in /etc/ssh/sshd_config.d/, which can override the main file:

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password

Check the syntax and reload:

sshd -t && systemctl reload ssh || systemctl reload sshd

Use an SSH config file for shortcuts

On your computer, ~/.ssh/config saves typing:

Host myvps
    HostName 203.0.113.10
    User root
    Port 22
    IdentityFile ~/.ssh/id_ed25519

Now ssh myvps is enough, and tools like scp and rsync use the same alias.

Troubleshooting

• Permission denied (publickey): check permissions on ~/.ssh and authorized_keys, that the key is on one line, and that you log in as the user whose file holds the key.
• Still asked for a password: the server is not accepting the key. Run ssh -v and read the server log with journalctl -u ssh (or sshd).
• Locked out: use your provider's VNC/console to log in and set PasswordAuthentication yes temporarily.

SSH key FAQ

Is ed25519 better than RSA?

Yes for new keys: ed25519 keys are short, fast and secure. Use RSA 4096 only for very old servers that do not support ed25519.

Can I use one key on many servers?

Yes. The same public key can go into any number of authorized_keys files. Use separate keys per device so you can revoke one lost laptop without touching the others.

How do I revoke a key?

Delete its line from ~/.ssh/authorized_keys on each server. The change takes effect for new connections immediately.

Does cPanel hosting support SSH keys?

Yes, where SSH access is enabled you can import or generate keys under cPanel → Security → SSH Access.

Next steps

• SSH lockdown checklist for a VPS
• SSH tunnels and port forwarding
• Linux essential commands cheat sheet