Generate an SSH key pair on your computer, copy only its public key to the VPS account’s ~/.ssh/authorized_keys file, verify a new key-authenticated session, and then decide whether to disable password-based access. Keep the private key on your computer, protected by a strong passphrase; it should never be pasted into the VPS.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What SSH keys do on a VPS
SSH public-key authentication uses two mathematically related files. Your client keeps a private key, while the VPS stores the matching public key. During login, the SSH client proves that it controls the private key without sending that private key to the server. The server accepts the login only when the public key appears in the account’s authorized-key file.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThis separates authentication from a reusable password. A stolen copy of the public key is not enough to log in; possession of the private key and, normally, its passphrase is required. You can also revoke one person’s access by deleting that person’s public-key line rather than changing a password shared by several administrators.
The normal sequence is:
- Create a key pair on the client.
- Use your existing VPS access method to install the public-key line for the correct user.
- Check the file’s owner and permissions.
- Open a second terminal and prove that a fresh connection works with the key.
- Only then change the SSH daemon policy, such as disabling password authentication.
What you need before starting
- An existing way into the VPS, such as the provider console, a temporary password, or another administrator’s working SSH session. Do not remove that path until the replacement key has been tested.
- An OpenSSH client on your computer. The commands below use the standard
ssh,ssh-keygen, and, when available,ssh-copy-idprograms. - The VPS username that should receive the key. Installing a key for
rootdoes not grant access to a separate unprivileged account, and installing it for the wrong user is a common cause of a public-key denial. - Console or provider recovery access in case a configuration change prevents SSH logins.
Generate a key pair on your client
Check whether a suitable key already exists
List your SSH directory before creating anything:
ls -la ~/.sshA file such as ~/.ssh/id_ed25519 is a private key; the matching ~/.ssh/id_ed25519.pub is the public key. Do not overwrite an existing private key that you still use. Create a separately named key instead, for example ~/.ssh/vps_admin_ed25519.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Create an Ed25519 key
Where the installed OpenSSH version supports Ed25519, it is a practical default:
ssh-keygen -t ed25519 -a 100 -f ~/.ssh/vps_admin_ed25519 -C 'admin@laptop-2026'When prompted, enter a long passphrase that is different from your VPS password. The -a 100 value asks for additional passphrase-protection work; the exact acceptable value depends on the OpenSSH version. If you omit -f, the usual default filename is ~/.ssh/id_ed25519.
This command creates two files:
~/.ssh/vps_admin_ed25519: the private key. Keep it confidential, back it up only through a method you trust, and never upload it to the VPS.~/.ssh/vps_admin_ed25519.pub: the public key intended for the VPS.
The OpenSSH ssh-keygen(1) manual states: “The contents of this file should be added to ~/.ssh/authorized_keys on all machines where the user wishes to log in using public key authentication.”
Protect the local private key
On a Unix-like client, check that your private key is not readable by other local users:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/vps_admin_ed25519
chmod 644 ~/.ssh/vps_admin_ed25519.pubThe public file can be copied or displayed; the private file cannot. If you use an agent, load the key explicitly and verify which identities are present:
ssh-add ~/.ssh/vps_admin_ed25519
ssh-add -lAn agent keeps the unlocked key available to client processes so you do not type the passphrase for every connection. Lock or clear the agent when you finish an administrative session on a shared or temporary computer.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteInstall the public key on the VPS
Method 1: use ssh-copy-id
If your client provides ssh-copy-id, run it while you still can authenticate with the existing method:
ssh-copy-id -i ~/.ssh/vps_admin_ed25519.pub [email protected]It asks for the VPS account’s current authentication method, creates or updates the account’s SSH directory, and appends the public-key line. The -i option is important when the key does not use the default filename. Review the command’s target username and hostname before accepting a prompt.
Method 2: append the line manually
For a client without ssh-copy-id, send the public file through an already authenticated SSH session:
cat ~/.ssh/vps_admin_ed25519.pub | ssh [email protected] 'umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys; chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys'This transfers the public key only. The shell command creates the directory if necessary, appends rather than replaces existing keys, and applies restrictive modes. Confirm that the command is executed as the destination user. If you accidentally run it as another account, the key will be placed in that account’s home directory and will not authenticate the intended user.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Installing for another account with administrative access
When you are logged in as root or another administrator and need to install a key for a user such as alice, create the directory and set its ownership explicitly:
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
sudo sh -c 'cat /tmp/alice-vps.pub >> /home/alice/.ssh/authorized_keys'
sudo chown alice:alice /home/alice/.ssh/authorized_keys
sudo chmod 600 /home/alice/.ssh/authorized_keysPlace the public file at /tmp/alice-vps.pub through a trusted method, verify that it contains one complete public-key line, and remove the temporary copy afterward. Adjust the home path and group to match the actual account. Never use this procedure with the private-key file.
Understand authorized_keys
Unless the daemon configuration changes it, sshd checks the per-user files ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2. The AuthorizedKeysFile setting can override those locations, so a key in the apparent default file may be ignored.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Each accepted key normally occupies one physical line. A line can contain optional restrictions, a key type, base64-encoded key data, and a comment:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... admin@laptop-2026Do not wrap the line across multiple lines or insert extra characters into the base64 portion. The trailing comment is a label, not part of the authentication secret; use it to identify a device or owner so that an individual key can later be rotated.
| Item | Normal value | Why it matters |
|---|---|---|
| Directory | ~/.ssh |
Must belong to the login user and should not be writable by other users. |
| Authorization file | ~/.ssh/authorized_keys |
Contains one permitted public key per line unless AuthorizedKeysFile specifies another path. |
| Private key | Client-side file such as ~/.ssh/vps_admin_ed25519 |
Stays on the client; do not copy it to the server. |
| Public key | Matching .pub file |
Safe to install on the VPS and intended for the authorization file. |
Test a new key before changing SSH policy
Keep the original SSH or console session open. Open a second terminal and force the client to use the new private key:
ssh -o IdentitiesOnly=yes -i ~/.ssh/vps_admin_ed25519 [email protected]IdentitiesOnly=yes prevents unrelated keys loaded in your agent from masking a configuration mistake. A successful login proves that the username, host, private-key path, public-key line, file permissions, and server policy work together. Close neither session until this test succeeds.
If the connection succeeds, inspect the remote identity to ensure you reached the expected account:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →whoami
hostnameFor a failure, run a verbose client attempt:
ssh -vvv -o IdentitiesOnly=yes -i ~/.ssh/vps_admin_ed25519 [email protected]Look for whether the client offered the intended key and whether the server accepted it. Verbose output can expose a wrong filename, an unexpected username, a host alias pointing elsewhere, or a key rejected before authentication. Do not publish verbose logs if they contain hostnames, usernames, or policy details you consider sensitive.
Confirm public-key authentication in sshd
On the VPS, inspect the effective SSH daemon configuration rather than relying only on comments in the configuration file. The relevant switch is:
PubkeyAuthentication yesThe OpenSSH manual defines this setting as: “Specifies whether public key authentication is allowed. The default is yes.” Ubuntu’s server guidance likewise instructs administrators to ensure it is set to yes.
Configuration files can include other files, and a Match block can apply different values to a particular user, host, or source address. Check the complete effective configuration and confirm that the account you tested is covered by the value you intend. A setting in a later or more specific section can explain why a global-looking line does not produce the expected behavior.
Disable password login only after verification
If your policy is key-only access, edit the active daemon configuration and set:
PasswordAuthentication noPassword authentication and keyboard-interactive authentication are separate methods. Review KbdInteractiveAuthentication, PAM integration, and any Match blocks before assuming that changing PasswordAuthentication removes every non-key route. Some environments deliberately retain keyboard-interactive prompts for an additional factor; disabling it without understanding the local policy can break that access method.
Use the distribution’s syntax-check mode before reloading. A common OpenSSH installation accepts:
Recommended Free Tools
sudo sshd -tNo output normally indicates that the file parsed successfully; an error identifies a line that must be corrected. On systems where the daemon binary or configuration path differs, use that distribution’s documented sshd test command. Then reload rather than restart so existing sessions remain available:
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
sudo systemctl reload sshdSome Debian-based systems name the service ssh instead:
sudo systemctl reload sshImmediately open another key-authenticated connection after the reload. Keep the original session and console recovery path until the second connection works with the final policy. A syntax check confirms that the file is valid; it does not prove that the intended user, key path, or authentication method is usable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common failures
“Permission denied (publickey)”
- Confirm the login username exactly; a key installed in
/home/alicewill not authorizebob. - Display the public key on the client and compare it with the complete line on the VPS. Ensure it was not wrapped or truncated.
- Check that the server is reading the path you used. An
AuthorizedKeysFileoverride or aMatchblock may point elsewhere. - Verify that the login user owns
~/.sshandauthorized_keys, that the directory mode is restrictive, and that the file is not writable by other users. - Run the client with
-vvvand inspect the server’s authentication logs through the distribution’s journal or log facility. The server-side message usually distinguishes a missing key from a permissions or policy rejection.
A password prompt still appears
First force the intended identity with -o IdentitiesOnly=yes -i. If the client never offers that key, check the path, agent state, and local permissions. If it offers the key but the server falls back to a prompt, verify PubkeyAuthentication yes, the effective authorized-key path, and the separate PasswordAuthentication and KbdInteractiveAuthentication settings. A password prompt does not by itself prove that public-key authentication is disabled; it may simply be a fallback after the offered key was rejected.
The new policy locks everyone out
Use the still-open session or provider console to restore a known-good setting, correct the key installation, and run the daemon’s syntax test before reloading again. If neither works, follow the provider’s emergency console or recovery procedure. This is why a second tested key session and an out-of-band recovery path are operational requirements, not optional conveniences.
The server has several administrators
Give each person and device its own public-key line. Sharing one private key prevents reliable attribution and forces you to replace the same credential for everyone when one device is lost. Label comments with an owner and device, then remove only the departed or compromised person’s line.
Rotate and revoke keys safely
- Generate a replacement key on the client and protect it with a new passphrase.
- Append the replacement public key to the target account’s
authorized_keys; do not delete the working line yet. - Open a separate session using the replacement private key and verify the account and host.
- Remove the old public-key line from the server file, taking care not to alter another administrator’s line.
- Test again and update your emergency access record.
For a lost or suspected-compromised private key, remove its public counterpart as soon as you have another verified route. A passphrase protects a stolen file, but it does not make a compromised key permanently trustworthy.
Use a FIDO2 security key for hardware-backed SSH credentials
Current OpenSSH documentation includes FIDO-backed key types such as ecdsa-sk and ed25519-sk. These keys use a compatible FIDO2 USB or NFC security key and can require a physical touch or user verification on the device.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →To create an Ed25519 security-key credential, connect the hardware key and run:
ssh-keygen -t ed25519-sk -f ~/.ssh/vps_admin_ed25519_sk -C 'admin@hardware-key-2026'The device may ask you to touch it during registration and use a PIN when local user verification is required. Install the resulting .pub file exactly as you would a software-generated public key. The private operation is tied to the security key rather than being a freely copyable private-key file.
OpenSSH’s PubkeyAuthOptions can enforce these behaviors server-side:
PubkeyAuthOptions touch-required
PubkeyAuthOptions verify-requiredtouch-required requires physical presence; verify-required requires user verification such as a PIN. Apply these options only after confirming that every authorized user has compatible hardware and a tested recovery key.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Consideration | File-based Ed25519 key | FIDO-backed *-sk key |
|---|---|---|
| Private-key protection | Protected by local file permissions and, ideally, a passphrase. | Private operation is hardware-backed; the security key normally must be present. |
| Portability | Can be used from any trusted client where the private key is securely available. | Requires carrying a compatible USB or NFC security key. |
| Touch or PIN | Not inherently required; an agent can cache a passphrase-unlocked key. | Touch can be required, and PIN-based user verification can be required. |
| Backup | Encrypted backups of the private key can restore access if the original client is lost. | Losing the hardware key may remove access; enroll and test another key or retain a separate recovery credential. |
| Client compatibility | Supported broadly by modern OpenSSH clients. | Requires an OpenSSH version and operating environment with FIDO support plus compatible hardware. |
| Rotation and revocation | Delete the corresponding public-key line and install a replacement. | Revoke the lost device’s public-key line and enroll a replacement security key. |
Key-only versus mixed authentication
| Policy | Advantages | Costs and risks |
|---|---|---|
Key-only (PasswordAuthentication no, with other methods reviewed) |
Removes password guessing and reuse as an SSH route and makes access depend on registered keys. | A misplaced key, incorrect permissions, or an incomplete rotation can cause an outage; console or recovery access is essential. |
| Mixed authentication | Provides a fallback when a key is unavailable and can simplify initial deployment. | Leaves password or keyboard-interactive methods exposed according to their settings, increasing the number of authentication paths that must be monitored and secured. |
Choose the policy that matches your recovery capability. Key-only access is sensible when every administrator has a tested key and an emergency route. Mixed access can be a deliberate transitional or operational choice, but document which methods remain enabled and who can use them.
Quick Recap
Final deployment checklist
- The private key exists only on approved client devices and is protected by a strong passphrase or hardware policy.
- The matching public key is installed for the correct VPS account.
~/.sshis owned by that account with mode700, andauthorized_keysis owned by that account with mode600.- The effective daemon configuration allows
PubkeyAuthentication. - A second terminal has successfully logged in with the intended key and username.
- Any change to password or keyboard-interactive authentication was syntax-tested, reloaded, and followed by another fresh-login test.
- Each administrator has an individual key, and there is a documented rotation and emergency-recovery procedure.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
