SSH Key Authentication on a VPS: Key Generation, Agent Forwarding, and Lockdown Techniques

Secure Shell (SSH) key authentication remains the gold standard for VPS access, but many administrators only implement the basics. This tutorial covers production-grade SSH key management including hardware-backed key generation, agent forwarding with security boundaries, and complete password authentication lockdown.

Generating Strong SSH Keys

Modern VPS environments should use Ed25519 keys for optimal performance and security. Run the following on your local machine:

ssh-keygen -t ed25519 -a 100 -f ~/.ssh/vps_key -C "[email protected]"

For legacy compatibility with older systems, use RSA with a 4096-bit minimum:

ssh-keygen -t rsa -b 4096 -o -a 100 -f ~/.ssh/vps_key_rsa

The -o flag ensures the key is saved in the newer OpenSSH format with bcrypt KDF for improved passphrase protection.

Deploying Public Keys to VPS Instances

Use ssh-copy-id for initial deployment while password auth is still enabled:

ssh-copy-id -i ~/.ssh/vps_key.pub user@your-vps-ip

For bulk deployment across multiple VPS instances, script the process using a loop:

for host in host1.example.com host2.example.com host3.example.com; do
  ssh-copy-id -i ~/.ssh/vps_key.pub deploy@"$host"
done

SSH Agent Forwarding with Security Boundaries

Agent forwarding lets you authenticate from a bastion host to internal servers without storing private keys remotely. Enable it with the -A flag:

ssh -A -i ~/.ssh/vps_key [email protected]

To limit forwarding risk, configure per-host restrictions in ~/.ssh/config:

Host bastion.example.com
  ForwardAgent yes
  HostName 192.168.1.10
  User deploy

Host *.internal.example.com
  ForwardAgent no
  ProxyJump bastion.example.com

Never enable agent forwarding on untrusted hosts. Use ssh -J (ProxyJump) as a safer alternative for most use cases.

Locking Down Password Authentication

Once key-based authentication is verified working, disable password login in /etc/ssh/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
PermitRootLogin prohibit-password
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

Test the configuration before restarting SSH by running sshd -t. Then reload:

sudo systemctl reload sshd

Keep a second SSH session active while testing to avoid locking yourself out. If something goes wrong, use your VPS provider’s out-of-band console to recover access.

Auditing and Key Rotation

Regularly audit authorized keys across all VPS instances. This script scans for stale or unauthorized keys:

#!/bin/bash
# audit-ssh-keys.sh
for host in $(cat vps-hosts.txt); do
  echo "=== $host ==="
  ssh "$host" "cat ~/.ssh/authorized_keys"
  ssh "$host" "lastlog -u \$(whoami)"
done

Implement key rotation by generating new keys, deploying them, then removing old keys from authorized_keys after a transition period. Automation tools like Ansible can handle this at scale across your entire infrastructure.

For additional VPS security hardening techniques, explore our full range of VPS management tutorials covering firewalls, intrusion detection, and automated patching.