To connect to a self-managed VPS or VDS with an SSH key, run ssh -i /path/to/private_key USERNAME@SERVER_IP from a terminal on your own computer, replacing each placeholder with the values for your server. The public key must already be installed for that account on the server, and you must use the matching private key. If your server listens on a non-default port, add -p PORT. Provider defaults vary, so take the address, username, and port from your server control panel or from your administrator rather than assuming them.
What you need before the first connection
Gather these five items first. Most failed first attempts trace back to one of them being guessed rather than confirmed.
As an Amazon Associate I earn from qualifying purchases.
- Public IP address or hostname of the server, as shown in the VPS/VDS service panel.
- Login username for the account the key was installed under.
rootappears in many examples, but use the account provisioned for your server. - Path to the private key on the computer you are connecting from. This is the half of the pair that never leaves your machine.
- SSH port configured on the server. Port 22 is the default in many guides, but the server can be set to another number.
- Network access: confirmation that any provider firewall or security group allows inbound SSH from the IP address you are connecting from.
The public key and private key are a matched pair. Anyone can see the public key; the private key should be readable only by you or by your local security infrastructure. Microsoft’s Azure documentation states the principle this way: your public key can be shared with anyone, but only you or your local security infrastructure should have access to your private key.
Run the connection command
The same OpenSSH syntax works across operating systems. Only the terminal and the way you write the key path differ.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Linux and macOS
Open Terminal and run:
ssh -i /path/to/private_key USERNAME@SERVER_IPUse -i to name the key explicitly. Without it, the client tries its default key files, which may not include the one that matches your server. If ssh is not found, install an OpenSSH client for your operating system before continuing.
Windows
Open PowerShell or Windows Terminal and use the Windows-style path to the key:
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh -i C:UsersYourName.sshid_ed25519 USERNAME@SERVER_IPRecent Windows versions include the OpenSSH client commands. If ssh is not recognized, install the optional OpenSSH Client feature from Windows optional features, then open a new terminal window. Availability and installation steps depend on your Windows version, so check the instructions that match your edition. The key file name shown here (id_ed25519) is only an example; substitute the file you actually generated.
Servers that use a non-default port
If the server listens on a port other than 22, add -p followed by the port number:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh -i /path/to/private_key -p PORT USERNAME@SERVER_IPUse the port your server is actually configured to accept. You do not need to change the server’s port to connect; the client should match the server.
Computers with several keys
If your computer holds keys for several servers, always pass -i. Relying on the client to pick a key is the most common reason a connection uses the wrong identity and then fails with an authentication error.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Handle the first host-key prompt safely
The first time you connect to a server, OpenSSH typically displays the server’s host-key fingerprint and asks whether you want to continue. This is the client checking that the server is who it claims to be. Before typing yes, compare the fingerprint with a value supplied through a trusted channel, such as your hosting control panel or your administrator. Bluehost’s guide for self-managed VPS/VDS servers, updated September 16, 2026, advises accepting when the server and IP address are recognized. If the fingerprint does not match what you were given, or you have no reference value, stop and confirm it with the provider before accepting. Accepting an unfamiliar fingerprint automatically removes the protection the prompt exists to provide.
When the connection fails
Two different failure types look similar but have different causes. A timeout or refusal means your computer did not reach the SSH service. A Permission denied (publickey) message means you reached the server, but it rejected the key. Identify which one you have before changing anything.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Permission denied (publickey)
Check these in order:
- The private key passed with
-iis the one whose public key is installed on the server. - The username is the account for which that public key was installed.
- The server address is correct and points to the server you intend to reach.
- The key file is available to your local SSH client and its local permissions are restrictive enough for your operating system. The private key should not be shared with other local accounts.
These are the causes named in Bluehost’s support article for this procedure. Fix one item at a time and retry, so you can tell which change worked.
Connection times out or is refused
Start with reachability:
- Confirm the server is running in your control panel and that the IP address has not changed.
- Confirm the SSH port number matches the server configuration.
- Allow inbound SSH through the provider firewall or security group. AWS’s documentation for Linux instances instructs users to allow inbound SSH traffic from their own IP address in the instance security group, which is a narrower rule than opening SSH to everyone.
- Check any firewall running on the server itself, since a rule there can block SSH even when the provider firewall allows it.
A timeout usually points to reachability or filtering. A rejected key points to authentication. This distinction is a useful troubleshooting heuristic rather than a guarantee for every network, because corporate or public Wi-Fi can filter traffic in ways that look like a timeout.
Connecting to the wrong port
If you see a refusal or timeout and you are sure the address is correct, check the port. Add -p PORT with the value from your server configuration. Using port 22 against a server configured for another port will fail even though the command syntax is correct.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
