You can add a second SSH key to the same Linux VPS account without replacing the key that already works. Generate a new key pair on the client computer, leave its private key there, and append only the new public-key line to the account’s ~/.ssh/authorized_keys file. Keep your current SSH session open, test the new key explicitly, and only then consider retiring the old one.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
How multiple SSH keys work
SSH key authentication uses a key pair. The client keeps a private key, while the server stores the matching public key. When you connect, the SSH server checks the public-key lines in the target account’s ~/.ssh/authorized_keys. Any matching line can authorize that user.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That means one Linux account can have several independent keys. Adding a line to authorized_keys does not overwrite the existing line. Each key can belong to a different computer, administrator, automation client, or recovery device. The private half of each pair must remain with the client that uses it; only the public half belongs on the VPS.
Ubuntu’s server documentation recommends the Ed25519 algorithm because it provides a shorter key with lower computational requirements. The examples below use Ed25519 and a deliberately separate filename so the new identity cannot be confused with an existing default key.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before you change the VPS
- Confirm the Linux username that should receive the key. A key installed for one account does not automatically authorize another account.
- Identify the VPS hostname or IP address and its SSH port. The examples use the default port unless your server uses a different one.
- Keep the current SSH window open while making and testing the change. It is your recovery path if the new key was copied to the wrong account or file.
- Decide where the new private key will live on your client computer. Do not upload it, paste it into a web console, or place it on the VPS.
- Make sure you can use one of the installation paths below: password authentication, an already-working SSH session, or a provider recovery console.
Method 1: Generate a separate key pair locally
Run ssh-keygen on your client
Run this command on the computer that will make the second SSH connection, not inside the VPS shell:
ssh-keygen -t ed25519 -f ~/.ssh/vps_second_ed25519The -t ed25519 option selects the recommended algorithm. The -f option gives the pair an unambiguous name instead of allowing the command to use a generic default filename.
Free tools Windows power users keep installed
One-click scans. No signup required.
When prompted, enter a passphrase. A passphrase protects the private key if somebody obtains the file from your client computer. Confirm it when prompted. The command creates two files:
~/.ssh/vps_second_ed25519— the private key. Keep it on the client and protect it.~/.ssh/vps_second_ed25519.pub— the public key. This is the only file that must be copied to the VPS.
Do not substitute the private filename when installing the key. A server needs the complete single-line contents of the .pub file.
Method 2: Install the key with ssh-copy-id
Use this when password login still works
ssh-copy-id is the simplest password-assisted route. From the client, run:
ssh-copy-id -i ~/.ssh/vps_second_ed25519.pub [email protected]Replace user with the target Linux account and vps.example with the VPS hostname or address. If the server listens on a non-default SSH port, supply that port using the SSH client’s port option:
Recommended Free Tools
ssh-copy-id -p PORT -i ~/.ssh/vps_second_ed25519.pub [email protected]The -i option is important when you have more than one local key. It tells the utility exactly which public key to install. The utility asks for the account’s current password, connects, and appends the selected key to that user’s ~/.ssh/authorized_keys. Ubuntu’s ssh-copy-id documentation says it can create the .ssh directory and file when they do not yet exist.
After the command completes, do not assume that the key you tested is the one being used. Verify with an explicit private-key path as shown below.
Method 3: Append the key through an existing SSH session
Keep the working connection open
This method is useful when password authentication is disabled but you already have a functioning SSH login. Open a second terminal on your client and run:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
cat ~/.ssh/vps_second_ed25519.pub | ssh [email protected]
'umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys'The local cat reads only the public file. SSH transports that line to the server, where the remote command creates the directory if necessary and appends the line to the account’s key file. umask 077 ensures newly created files and directories start private to the account.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →If your current session uses a non-default SSH port, include it on the SSH part of the pipeline:
cat ~/.ssh/vps_second_ed25519.pub | ssh -p PORT [email protected]
'umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys'Append manually when you are already at the VPS shell
You can also display the public key on the client, copy its complete line, and open the remote file in an editor:
nano ~/.ssh/authorized_keysPaste the new public-key line at the end of the file, save it, and leave every existing line intact. A public key is normally one long line containing the key type, encoded key data, and an optional comment. Do not wrap it across lines, remove characters, or paste the private-key file.
Method 4: Use the VPS provider’s recovery console
When no SSH login works
If you cannot log in over SSH, use the provider’s web console or serial recovery console. Log in with an administrator account, or use the provider’s documented password-reset or recovery procedure, then append the public key to the intended user’s file.
From the recovery shell, switch to the target account if appropriate and create the directory and file with restrictive permissions:
mkdir -p /home/user/.ssh
cat >> /home/user/.ssh/authorized_keys
chmod 700 /home/user/.ssh
chmod 600 /home/user/.ssh/authorized_keysFor the cat command, paste the complete public-key line and finish the input according to the console’s shell behavior. Ensure the files belong to the target account; an administrator can correct ownership with the system’s account-management tools. The essential requirement is that the intended user can read the key file and that it is not writable by unrelated users.
A recovery console is a fallback, not a reason to remove the old key. Add the new line, exit the console, and test a normal SSH connection before changing anything else.
Verify the second key before closing the old session
Force an explicit private key
From the client, test the new identity directly:
ssh -i ~/.ssh/vps_second_ed25519 [email protected]For a non-default port:
ssh -p PORT -i ~/.ssh/vps_second_ed25519 [email protected]The command should authenticate as the intended username and open a normal shell. Explicitly naming the private key prevents your SSH client from silently selecting an older identity from its defaults or agent.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Create a reusable host entry
To make future connections predictable, add a host block to the client’s ~/.ssh/config:
Host my-vps-second-key
HostName vps.example
User user
IdentityFile ~/.ssh/vps_second_ed25519
IdentitiesOnly yesConnect with:
ssh my-vps-second-keyIdentityFile selects the new private key. IdentitiesOnly yes tells the client to use the identities specified for this host rather than trying unrelated keys offered by an agent. Ubuntu’s SSH guidance documents selecting keys per target through ~/.ssh/config and supports using multiple keys.
Keep the original connection until the test succeeds
Do not close the working session immediately after copying the key. Keep it open until the explicit test has succeeded and you have confirmed the username, host, port, and permissions. If the new connection fails, the old session lets you inspect and repair the account without relying on a console.
Permissions and ownership that commonly block login
When a key is present but rejected, check the target account and the path first. The key must be in that account’s ~/.ssh/authorized_keys, not in the administrator’s home directory or another user’s file.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteFrom a session for the target account, a commonly strict permission setup is:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keysUbuntu also documents removing group and other write permissions from the key file:
chmod go-w ~/.ssh/authorized_keysIf an administrator created the files, verify that the target account owns them. A wrong owner can prevent the SSH daemon from trusting the file even when the contents are correct. Correct ownership with your operating system’s account-management command, using the intended username and home directory.
Diagnose a failed test systematically
1. Confirm that the client is using the new key
Run a verbose connection with the explicit private-key path:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →ssh -vvv -i ~/.ssh/vps_second_ed25519 [email protected]Read the output for the identity being offered and the server’s response. If the output shows a different key, check the path, the host alias, and any SSH-agent or configuration settings. The -i path must name the private file without the .pub suffix.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Confirm that the public and private halves match
Make sure the line copied to the VPS came from ~/.ssh/vps_second_ed25519.pub and that you are testing ~/.ssh/vps_second_ed25519. Installing one pair’s public key while testing another pair’s private key cannot authenticate.
3. Confirm the account, host, and port
A valid key in the wrong account is still rejected. Check the username in the command, the host address, and the SSH port. A host alias in ~/.ssh/config can also override the values you expect, so compare the alias with the explicit command.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 114. Inspect the server log while testing
On Ubuntu systems, follow the SSH service journal from the existing session or recovery console:
sudo journalctl -fu ssh.serviceStart the verbose client test in another terminal and watch the live log for the server’s reason. This can reveal a bad path, permission problem, wrong account, or another server-side rejection without guessing.
5. Check the key file’s formatting
Open ~/.ssh/authorized_keys and verify that the new public key is a complete single line. Remove accidental line breaks or truncated text, but do not alter the existing key lines. If you copied the line through a terminal or browser, compare it with the original .pub file on the client.
Direct answers to common setup questions
Can two SSH keys work for the same Linux user?
Yes. The SSH server checks each public-key line in that user’s authorized_keys file. If either key matches the private key offered by the client, the login can succeed. The keys do not need to be generated on the same computer, and adding one does not disable the other.
How do you add a key without deleting the old one?
Append the new public-key line with ssh-copy-id, the pipe-and-append command, or a manual edit. Do not use a command that overwrites the file, and do not select all existing text for replacement in an editor. Leave the original line exactly where it is, then test the new pair in a separate terminal.
Which key should be copied to the VPS?
Copy only the contents of vps_second_ed25519.pub. The private file without the .pub suffix never needs to leave the client. If a command or editor asks for the key, confirm that the text begins with the public key type and remains one complete line.
What if password authentication is disabled?
Use the existing working SSH session to run the append pipeline or edit the file directly. If no SSH session works, use the VPS provider’s web or serial recovery console. These paths change the same file; they differ only in the access you have when installing the key.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Why does an apparently correct key still fail?
The most frequent checks are the username, home directory, SSH port, public/private pair, file ownership, permissions, and line formatting. A client with several keys may also offer a different identity than the one you intended. Use ssh -vvv -i and follow journalctl -fu ssh.service while testing so the client and server messages can be compared.
Choose the installation method that fits your access
| Method | Required access | How it changes the account | Explicit key selection | Best verification |
|---|---|---|---|---|
ssh-copy-id |
Working password authentication | Appends the selected public key and can create ~/.ssh and authorized_keys |
-i ~/.ssh/vps_second_ed25519.pub |
ssh -i ~/.ssh/vps_second_ed25519 user@host |
| Pipe and append | An existing SSH session or another working SSH login | Creates the directory with umask 077 and appends the public-key line |
Local cat names the exact .pub file |
Explicit ssh -i test while the original session remains open |
| Manual edit | An existing shell on the VPS | Adds one complete line without deleting existing lines | Copy the intended .pub file and test its matching private key |
Verbose SSH test and server journal |
| Recovery console | Provider web or serial console and administrator access | Appends the key to the intended user’s home directory during recovery | Paste only the public-key line from the client | Close the console only after a normal SSH connection succeeds |
What not to do
- Do not replace
authorized_keyswith the new key. Replacing the file can remove the only working login. - Do not upload the private key to the VPS. The server needs the public half only.
- Do not test with an unspecified command when several local keys exist. Use
-ior a host entry withIdentityFile. - Do not close the original session before the new key has authenticated successfully.
- Do not install the key under the wrong username or assume a key in one home directory applies to every account.
- Do not leave the new public key split across lines or with characters missing from the original file.
Safe handover checklist
- Generate a new Ed25519 pair with a distinct filename on the client.
- Protect the private key with a passphrase and keep it on that client.
- Append only the matching
.publine to the intended account’sauthorized_keys. - Preserve every existing key line.
- Check
~/.sshandauthorized_keyspermissions and ownership. - Test with
ssh -i, the correct username, hostname, and port. - Use
~/.ssh/configwithIdentityFileandIdentitiesOnly yesif you will use the key repeatedly. - Keep the original SSH session open until the new login is confirmed.
When you should remove the old key
Adding the second key is non-destructive. Removal is a separate change that should happen only after the new key works from the intended client and you no longer need the old credential. If you later retire it, open the target account’s authorized_keys, identify the old public-key line precisely, delete only that line, save the file, and test the new connection again. Keep another verified administrative path available before removing any key that might still be needed for recovery.
Frequently Asked Questions
Can I use two SSH keys for one Linux account?
Yes. Add both public-key lines to that account’s ~/.ssh/authorized_keys. SSH accepts whichever line matches the private key offered by the client.
Will adding a second key remove the first key?
No. Appending a line leaves existing lines unchanged. Avoid overwriting authorized_keys and verify the new login before closing the old session.
Do I copy the private key to the VPS?
No. Keep the private file on the client computer. Install only the complete one-line contents of its matching .pub file.
What is the easiest way to install the second key?
If password login still works, run ssh-copy-id -i ~/.ssh/vps_second_ed25519.pub [email protected]. The utility appends the selected key and can create the SSH directory and file.
How can I add a key when password authentication is disabled?
Use an existing SSH session to run the pipe-and-append command or edit authorized_keys manually. If no SSH login works, use the provider’s web or serial recovery console.
Why is SSH using the wrong key?
Specify the private key with ssh -i. For repeat connections, use an SSH config entry with IdentityFile and IdentitiesOnly yes so unrelated agent identities are not selected.
What permissions should the SSH files have?
A strict setup uses chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys. Also verify that the intended account owns the directory and file.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat should I check if the new key is rejected?
Confirm the username, host, port, matching public/private pair, complete single-line formatting, ownership, and permissions. Run ssh -vvv -i and watch sudo journalctl -fu ssh.service on Ubuntu.
The Bottom Line
Generate the second Ed25519 key on the client, append only its public line to the intended user’s authorized_keys, and test it with an explicit -i command. Keep the original session open until the new login works; remove the old key only after you have a verified replacement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
