SSH key authentication is the most secure and convenient way to log into your VPS. Instead of typing a password each time, you use a cryptographic key pair: a private key that stays on your local machine and a public key that lives on your server. This setup eliminates password brute-force attacks, speeds up logins, and lets you manage multiple servers with a single credential. This guide walks through the entire process, from generating keys to hardening your SSH daemon.<\/p>\n\n\n\n
On your local machine (not the server), generate a new key pair with the ed25519 algorithm \u2014 it is faster, shorter, and considered more secure than RSA for most purposes:<\/p>\n\n\n\n
ssh-keygen -t ed25519 -a 100 -C \"your-email@example.com\"<\/code><\/pre>\n\n\n\nYou will be prompted for a save location (default: ~\/.ssh\/id_ed25519<\/code>) and an optional passphrase. A passphrase adds a second factor: even if someone steals your private key, they cannot use it without the passphrase. We recommend setting one.<\/p>\n\n\n\nIf you need to connect to older systems that do not support ed25519, generate an RSA key instead:<\/p>\n\n\n\n
ssh-keygen -t rsa -b 4096 -C \"your-email@example.com\"<\/code><\/pre>\n\n\n\n2. Copy the Public Key to Your VPS<\/h2>\n\n\n\n
Use the ssh-copy-id<\/code> utility, which appends your public key to the server’s ~\/.ssh\/authorized_keys<\/code> file automatically:<\/p>\n\n\n\nssh-copy-id -i ~\/.ssh\/id_ed25519.pub user@your-vps-ip<\/code><\/pre>\n\n\n\nIf ssh-copy-id<\/code> is not available, you can do it manually:<\/p>\n\n\n\ncat ~\/.ssh\/id_ed25519.pub | ssh user@your-vps-ip \\\n \"mkdir -p ~\/.ssh && chmod 700 ~\/.ssh && \\\n cat >> ~\/.ssh\/authorized_keys && chmod 600 ~\/.ssh\/authorized_keys\"<\/code><\/pre>\n\n\n\n3. Test the Key-Based Login<\/h2>\n\n\n\n
Open a new terminal (or use ssh -o IdentitiesOnly=yes<\/code>) and connect to your VPS. If everything is configured correctly, you should log in without being prompted for a password (you may still be asked for your key passphrase if you set one):<\/p>\n\n\n\nssh user@your-vps-ip<\/code><\/pre>\n\n\n\nYou can also add a config entry in ~\/.ssh\/config<\/code> to simplify future logins:<\/p>\n\n\n\nHost my-vps\n HostName your-vps-ip\n User your-username\n IdentityFile ~\/.ssh\/id_ed25519\n AddKeysToAgent yes<\/code><\/pre>\n\n\n\nThen simply type ssh my-vps<\/code> to connect.<\/p>\n\n\n\n4. Disable Password Authentication<\/h2>\n\n\n\n
Once key authentication works reliably, disable password authentication to close the door on brute-force attacks. Edit the SSH daemon configuration:<\/p>\n\n\n\n
sudo nano \/etc\/ssh\/sshd_config\n\n# Set these values:\nPasswordAuthentication no\nPubkeyAuthentication yes\nPermitRootLogin no\n\nsudo systemctl restart sshd<\/code><\/pre>\n\n\n\nKeep a second terminal session open when you restart SSH. If your configuration has an error, you can still recover. Never disable password auth until you have verified key-based login works \u2014 otherwise you risk locking yourself out of your own server.<\/p>\n\n\n\n
5. Managing Keys Across Multiple Servers<\/h2>\n\n\n\n
You can reuse the same public key on multiple VPS instances, which simplifies management. However, if one server is compromised, all servers sharing that key are at risk. For high-security environments, use a dedicated key per server and store keys in a password manager or an SSH agent.<\/p>\n\n\n\n