How to Set Up SSH Key Authentication on Your VPS

SSH key authentication is the most secure and convenient way to log into your VPS. Instead of typing a password each time, you use a cryptographic key pair: a private key that stays on your local machine and a public key that lives on your server. This setup eliminates password brute-force attacks, speeds up logins, and lets you manage multiple servers with a single credential. This guide walks through the entire process, from generating keys to hardening your SSH daemon.

1. Generate an SSH Key Pair

On your local machine (not the server), generate a new key pair with the ed25519 algorithm — it is faster, shorter, and considered more secure than RSA for most purposes:

ssh-keygen -t ed25519 -a 100 -C "[email protected]"

You will be prompted for a save location (default: ~/.ssh/id_ed25519) and an optional passphrase. A passphrase adds a second factor: even if someone steals your private key, they cannot use it without the passphrase. We recommend setting one.

If you need to connect to older systems that do not support ed25519, generate an RSA key instead:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

2. Copy the Public Key to Your VPS

Use the ssh-copy-id utility, which appends your public key to the server’s ~/.ssh/authorized_keys file automatically:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@your-vps-ip

If ssh-copy-id is not available, you can do it manually:

cat ~/.ssh/id_ed25519.pub | ssh user@your-vps-ip \
  "mkdir -p ~/.ssh && chmod 700 ~/.ssh && \
   cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

3. Test the Key-Based Login

Open a new terminal (or use ssh -o IdentitiesOnly=yes) and connect to your VPS. If everything is configured correctly, you should log in without being prompted for a password (you may still be asked for your key passphrase if you set one):

ssh user@your-vps-ip

You can also add a config entry in ~/.ssh/config to simplify future logins:

Host my-vps
    HostName your-vps-ip
    User your-username
    IdentityFile ~/.ssh/id_ed25519
    AddKeysToAgent yes

Then simply type ssh my-vps to connect.

4. Disable Password Authentication

Once key authentication works reliably, disable password authentication to close the door on brute-force attacks. Edit the SSH daemon configuration:

sudo nano /etc/ssh/sshd_config

# Set these values:
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no

sudo systemctl restart sshd

Keep a second terminal session open when you restart SSH. If your configuration has an error, you can still recover. Never disable password auth until you have verified key-based login works — otherwise you risk locking yourself out of your own server.

5. Managing Keys Across Multiple Servers

You can reuse the same public key on multiple VPS instances, which simplifies management. However, if one server is compromised, all servers sharing that key are at risk. For high-security environments, use a dedicated key per server and store keys in a password manager or an SSH agent.

To remove access for a user, simply delete their key from ~/.ssh/authorized_keys. This is far cleaner than rotating passwords across all users.

6. Go Further with SSH Security

SSH key authentication is the foundation of a secure VPS. From here, you can add layers like two-factor authentication, Fail2ban, and a non-default port. If you are setting up a new server, take a moment to review our VPS security checklist to ensure your infrastructure is locked down from day one.

With SSH keys configured and password authentication disabled, your VPS is protected against the most common automated attack vectors. The combination of cryptographic keys and a passphrase gives you security and convenience that passwords simply cannot match.