How to set up SSH key authentication on a VPS

Password logins are the weakest part of a fresh server: bots scan the internet and hammer port 22 with guesses around the clock. Swapping passwords for an SSH key pair removes that attack surface entirely, and it's the first thing worth doing on any new VPS. Here's the whole process in a few commands.

How SSH keys work

You generate a pair: a private key that stays on your computer and a public key you place on the server. The server challenges anyone connecting; only the holder of the matching private key can answer. You can hand out the public key freely — it's the private key you protect.

1. Generate a key pair (on your own computer)

ssh-keygen -t ed25519 -C "you@example.com"
# press Enter to accept the default path (~/.ssh/id_ed25519)
# set a passphrase for extra safety, or leave empty

This creates two files: ~/.ssh/id_ed25519 (private — never share) and ~/.ssh/id_ed25519.pub (public).

2. Copy the public key to your server

The easy way, if you can still log in with a password:

ssh-copy-id root@YOUR.SERVER.IP

No ssh-copy-id? Do it by hand:

cat ~/.ssh/id_ed25519.pub | ssh root@YOUR.SERVER.IP \
  "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

3. Test the key before changing anything

Open a new terminal and log in — you shouldn't be asked for the server password:

ssh root@YOUR.SERVER.IP

If that works, keep this session open while you do the next step, so a mistake can't lock you out.

4. Turn off password login

On the server, edit /etc/ssh/sshd_config:

sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart ssh    # on some distros the service is named sshd

From now on only your key gets in, and the constant brute-force noise on port 22 simply bounces off.

Honest cautions

• Never disable passwords before your key works. Confirm the key login in a second terminal first — that's the one rule that prevents a lockout.
• Back up your private key, and consider adding a second key (a laptop and a backup) so losing one device isn't a lockout.
• If you do get locked out, a provider console gets you back in — EQVPS gives every VPS a browser console for exactly this.

Next steps

An SSH key is step one of a hardened server. Pair it with a firewall — see how to configure a UFW firewall and how to set up fail2ban — and run the full new-VPS security checklist before exposing anything. On a no-KYC crypto-paid VPS, a key is also how you keep access truly yours.