SSH keys and two-factor authentication solve different problems. A normal SSH key is one cryptographic authentication factor: your client proves it has the private key matching a public key in the server user’s ~/.ssh/authorized_keys. Two-factor authentication (2FA) adds a separate requirement, such as a FIDO2/U2F security key or a time-based one-time password (TOTP).
For most VPS installations, start with a passphrase-protected Ed25519 key, create and test a non-root login, then turn off password authentication and direct root login. Add a second factor when the extra operational work is justified, and prepare console access, spare credentials and a revocation procedure before changing SSH settings.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What an SSH key proves—and what it does not
SSH public-key authentication uses asymmetric cryptography. The server stores a public key; your SSH client keeps the corresponding private key. During login, the client signs data with the private key and the server verifies that signature with the public key. The private key itself is not sent to the VPS.
That proof is a single factor: possession of the private key. A passphrase on the private-key file is valuable because it protects the file if a laptop backup or disk is copied, but the passphrase is normally checked by your local SSH client, not by the VPS as a separate authentication step. Anyone who obtains an unlocked private key can generally use it until you revoke the matching public key.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Ubuntu’s Server documentation describes SSH as authentication between hosts without a password by using cryptographic keys. DigitalOcean likewise calls SSH keys its recommended authentication method for Droplets and says Droplets created with a key have password authentication disabled by default. Those defaults reduce password-guessing exposure, but they do not turn a key into two-factor authentication.
What 2FA adds
Two-factor authentication requires two independent categories of evidence. In an SSH deployment, the first factor can be your ordinary public key; the second can be a physical FIDO/U2F device or a code generated by an authenticator application. A stolen private key alone should not be enough when the server is configured to require both factors.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →FIDO2 and U2F security keys
OpenSSH 8.2 added support for U2F/FIDO hardware authentication devices. A security key performs a cryptographic operation internally and must be present at login. This is substantially more resistant to phishing than a code that can be copied from a screen, although the exact protection depends on how the SSH account and key are configured.
TOTP through PAM
A PAM-backed TOTP setup asks for an interactive code after the public-key step. Ubuntu documents the following relevant sshd_config settings:
PubkeyAuthentication yes
KbdInteractiveAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive:pamThe comma in AuthenticationMethods means the public key must succeed before the PAM interactive challenge is accepted. Ubuntu releases and PAM stacks can differ, so verify the syntax against the OpenSSH version installed on your server and retain an out-of-band recovery route.
SSH keys versus 2FA at a glance
There is no authoritative common benchmark that assigns a numeric compromise rate to SSH keys versus 2FA for VPSs. The practical differences are qualitative:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches| Concern | Passphrase-protected ordinary SSH key | SSH key plus a second factor |
|---|---|---|
| Brute-force resistance | Very high when the private key is generated with a modern algorithm and password authentication is disabled; online password guessing is removed. | Retains the key’s resistance and adds another required proof. |
| Private key stolen | An attacker may log in with the stolen key, especially if its passphrase is known or the key was copied while unlocked; revoke it promptly. | The attacker still needs the configured hardware key or OTP factor. |
| Phishing resistance | Strong against password phishing, but malware or a stolen unlocked key can still authorize a session. | FIDO security keys provide the strongest phishing resistance of the options described here; TOTP codes can still be relayed in real time. |
| Unattended automation | Well suited to scheduled jobs, CI and configuration tools, using narrowly scoped keys and a protected agent. | Interactive hardware or OTP challenges can block unattended jobs; automation needs a separate design and risk review. |
| Recovery complexity | Manageable if you keep another authorized administrator key and provider console access. | Higher because both the key and the second-factor device or enrollment must be recoverable. |
| Hardware and support cost | No dedicated token is required; the cost is secure key storage and administration. | FIDO tokens require purchase, inventory and spares; TOTP requires enrollment, backup codes and a protected authenticator. |
A secure baseline for a new VPS
Use this order so that a hardening change does not lock you out:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Provision a normal administrator account with
sudo; avoid doing routine work as root. - Generate an Ed25519 key on a trusted workstation and protect its private file with a long passphrase.
- Install only the public key for the intended account in
~/.ssh/authorized_keys. - Open a new SSH session and verify that key login works before changing the daemon configuration.
- Open a second, independent session and keep the first one connected while testing.
- Disable password authentication and direct root login only after both sessions work.
- If you add 2FA, test the complete key-plus-second-factor flow and the emergency console path before ending your maintenance session.
Generate and install an Ed25519 key
1. Create the key on your workstation
Ubuntu recommends Ed25519 for general-purpose key generation. Run:
ssh-keygen -t ed25519 -C 'admin@laptop'Accept the default location unless you need separate identities, and enter a passphrase when prompted. The private key stays on the workstation; the file ending in .pub is the public key that may be copied to the server. RSA 4096 remains a compatible alternative when an older device or policy requires it:
ssh-keygen -t rsa -b 4096 -C 'admin@laptop'Do not email a private key, paste it into a ticket or store it in an unencrypted shared folder. If your workstation supports an SSH agent, load the key into the agent only when needed and lock the workstation when you step away.
2. Place the public key in the account
During cloud provisioning, paste the public-key text into the provider’s SSH-key field. For an already reachable server, ssh-copy-id can append the key:
ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]If you must install it manually, create the directory and file as the target user, then apply restrictive permissions:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
cat id_ed25519.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keysMake sure the file is owned by the login user. A key can be rejected when the home directory, .ssh directory or authorized_keys file is writable by other users.
3. Verify the identity and fingerprint
Before relying on the key, inspect its fingerprint locally:
Recommended Free Tools
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh-keygen -lf ~/.ssh/id_ed25519.pubCompare the displayed fingerprint with the key recorded in your provisioning system or server account. Then connect explicitly with the key:
ssh -i ~/.ssh/id_ed25519 [email protected]Use a separate terminal for the test. Never close your original administrative session until the new one has completed authentication and you have confirmed that sudo works.
Harden the SSH daemon without creating a lockout
Disable password authentication
After successful key login, edit the active SSH server configuration, normally /etc/ssh/sshd_config, and set:
PubkeyAuthentication yes
PasswordAuthentication noSome cloud images include configuration snippets under /etc/ssh/sshd_config.d/. A later snippet or a cloud-init override can supersede the line you changed, so check the effective configuration rather than assuming the first matching line wins:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sudo sshd -T | grep -E 'pubkeyauthentication|passwordauthentication|authenticationmethods|permitrootlogin'Validate syntax before reloading:
sudo sshd -tIf validation succeeds, reload rather than restart so existing sessions remain available:
sudo systemctl reload sshStart a fresh connection from the workstation. Keep the old session open while you test a second account, a second terminal and, if applicable, your 2FA challenge.
Prevent direct root login
DigitalOcean’s Ubuntu hardening guidance identifies disabling password authentication and direct root login as the two most important steps after key login has been proven. Set an appropriate value such as:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
PermitRootLogin noIf an emergency policy requires root key access, PermitRootLogin prohibit-password prevents password-based root login while still allowing keys. A normal administrator account with narrowly granted sudo rights is easier to audit and revoke than a shared root credential.
Free tools Windows power users keep installed
One-click scans. No signup required.
Add a second factor
Option A: use a FIDO security key
FIDO/U2F support requires an OpenSSH version and security key that implement the same key type. OpenSSH 8.2 introduced this capability. A typical key-generation command is:
ssh-keygen -t ed25519-sk -f ~/.ssh/id_ed25519_skIf the token does not support the Ed25519 security-key type, an ECDSA security-key type may be available:
ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_skDuring enrollment, touch the token when requested and set a token PIN if your device supports one. Copy the resulting public key to the server exactly as you would an ordinary key. Test from a new session with the token inserted; the expected behavior is that the SSH client cannot complete authentication when the required device is absent.
A FIDO key can be the required SSH credential, but whether your policy constitutes two independent factors depends on the configured authentication methods. If you need an ordinary key and a hardware key in sequence, configure and test the server’s supported AuthenticationMethods combination rather than assuming that two public keys in a file automatically create 2FA. Keep a spare enrolled token in a separate secure location.
Option B: require a PAM TOTP code after the key
Install and enroll a PAM-compatible TOTP module according to your Ubuntu release’s documentation. Then confirm these settings are active:
PubkeyAuthentication yes
KbdInteractiveAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive:pamThe client must first prove possession of the SSH key and then enter the current code. Test with a second session before closing the console session. Clock drift, an incorrect PAM enrollment, a disabled keyboard-interactive method or a conflicting configuration snippet can all prevent the prompt from appearing.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Store emergency codes in a protected offline location and document who can use them. Do not leave a permanent password-authentication exception merely because the TOTP setup is inconvenient; instead, keep provider console access and a tested alternate administrator credential.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Automation changes the decision
Human administrators and unattended processes have different authentication needs. A scheduled backup, deployment runner or configuration-management job cannot usually touch a FIDO token or type a changing code. Give automation a separate key rather than reusing a personal administrator key, restrict that key to the required account and command where your tooling supports it, and protect the private material in the job runner’s secret store.
Do not forward an agent to servers you do not control. An agent-forwarded socket can allow a compromised host to request signatures from keys loaded in your agent. For high-value production systems, separate interactive administration from machine-to-machine access and review the latter as its own risk.
Recovery when a key or token is lost
Lost private SSH key
If another administrator session, a second key or the provider console still works, remove the lost key’s complete line from the affected user’s authorized_keys file. If the key may have been copied, treat it as compromised even if you think its passphrase was strong. Generate a replacement on a trusted device, install and test it, then remove the old key from every server and provisioning system.
Lost FIDO token or authenticator
Use the spare token or a documented alternate factor to sign in. Remove the missing token’s public key or enrollment immediately, then enroll its replacement and test a new session. For TOTP, revoke the old secret and issue a new enrollment rather than continuing to trust a code generator that may be in someone else’s possession.
No working credential
Use the VPS provider’s out-of-band console or recovery workflow. Provider interfaces differ, but the general sequence is to access the disk or rescue environment, restore a known-good administrator public key, correct SSH configuration, validate it with sshd -t and reboot or reload. Keep this path documented before enabling 2FA; a recovery plan that exists only in someone’s memory is not a reliable control.
Troubleshoot before escalating
Key rejected with “Permission denied”
- Confirm the client is offering the intended identity with
ssh -vvv -i ~/.ssh/id_ed25519 [email protected]. - Check ownership and modes for the home directory,
.sshandauthorized_keys. - Verify that the public key was copied as one uninterrupted line and belongs to the private key selected by the client.
- Inspect server logs with
journalctl -u ssh -fwhile making a test connection.
Password still works after the change
Check the effective settings with sshd -T, including snippets in sshd_config.d and cloud-init-managed files. A configuration line that appears correct in one file may be overridden later.
No OTP prompt appears
Confirm that the public-key method succeeds, KbdInteractiveAuthentication and UsePAM are enabled, and AuthenticationMethods requires the PAM step. Review PAM logs and test the installed OpenSSH/PAM versions rather than copying a directive from a different Ubuntu release.
FIDO enrollment or login fails
Check the OpenSSH client and server versions, USB access, token presence and token PIN. Try the other supported security-key algorithm only if the device documents it. Keep an ordinary emergency key and console path available while diagnosing hardware support.
Which setup fits your VPS?
| Situation | Practical choice | Reason |
|---|---|---|
| One administrator, low-risk personal VPS | Passphrase-protected Ed25519 key, non-root account, password authentication disabled and provider-console recovery. | It removes password guessing without adding hardware-management overhead. |
| Several administrators or an internet-facing production service | Individual keys plus a second factor, preferably FIDO security keys, with spare-token inventory and documented revocation. | A stolen private key is less useful without the second factor, and individual credentials improve accountability. |
| Environment with unattended deployment | Interactive administrators use 2FA; automation uses a separate, restricted key with a managed secret and rotation schedule. | Jobs remain reliable without weakening human administrator accounts. |
| Strict policy requiring an OTP challenge | PAM TOTP after public-key authentication, validated against the installed Ubuntu and OpenSSH versions. | The documented publickey,keyboard-interactive:pam sequence enforces both steps. |
Bottom line
An ordinary SSH key is not 2FA; it is one strong cryptographic factor. Secure the VPS first with an Ed25519 key, a passphrase, a tested non-root login, disabled password authentication and restricted root access. Add FIDO2/U2F or PAM-backed TOTP when the threat model warrants a second factor, and treat spare credentials, console access and prompt revocation as part of the security design rather than as emergency afterthoughts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
