Generate an SSH key pair on your own computer, copy only the public key to the VPS account’s ~/.ssh/authorized_keys file, verify a new key-based login, and then disable password authentication if your recovery plan is ready. The private key never leaves your client device.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What SSH keys do on a VPS
SSH public-key authentication replaces a reusable account password with a cryptographic key pair. Your client keeps a private key, while the VPS stores the matching public key. During login, the server asks the client to prove it possesses the private key; the private key itself is not uploaded to the server.
As an Amazon Associate I earn from qualifying purchases.
The arrangement has two important consequences. First, anyone who obtains the private key may be able to log in as that account, so the file must be protected like a password that cannot be reset remotely. Second, the VPS can authorize several independent keys. Each administrator can use a separate key line, and one person’s access can be removed without changing everyone else’s credentials.
Private and public files
A typical Ed25519 pair is ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public). The private file remains on the client and should have a strong passphrase. The .pub file is the one intended for installation on the VPS.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The OpenSSH documentation describes the public-key file this way: “The contents of this file should be added to ~/.ssh/authorized_keys on all machines where the user wishes to log in using public key authentication.” On the server, sshd normally reads one public key per line from ~/.ssh/authorized_keys (and, unless changed, may also recognize ~/.ssh/authorized_keys2).
Prepare before changing access
Make these checks before opening an SSH session:
- Know the exact VPS hostname or IP address and the Linux username that should receive the key. A key installed for
rootdoes not authenticate a separate ordinary user. - Keep an existing SSH window, provider console, or other recovery channel open while testing. Do not close your only working session until a second session succeeds with the new key.
- Back up the private key securely. Do not paste it into a ticket, chat, shell command sent to another person, or server file.
- Plan how you will recover if a permissions mistake or configuration error blocks SSH. Provider consoles and out-of-band access are especially important when you intend to turn off passwords.
Step 1: Generate a key pair on your client
Use Ed25519 when the client supports it
Ed25519 is the preferred default for a modern OpenSSH client that supports it. The resulting key is compact and is normally created with ssh-keygen. Older clients may require another supported algorithm; use the strongest option available on that installed version rather than copying a private key from somebody else.
Create the key and protect it
- On your own computer, run
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519. If your client does not support Ed25519, omit the type only after checking which key types that client accepts. - When prompted, confirm the destination or choose a clearly identified filename. Avoid overwriting an existing key unless you have verified what uses it.
- Enter a long, unique passphrase. The passphrase encrypts the private key at rest; it is not sent to the VPS during authentication.
- Confirm that both files exist:
~/.ssh/id_ed25519and~/.ssh/id_ed25519.pub. Display the public file withcat ~/.ssh/id_ed25519.pubwhen you are ready to copy its single line.
Only the line from the .pub file should be transferred. It normally contains a key type, base64-encoded key data, and an optional comment. Never substitute the private file or a line that has been wrapped across multiple lines.
Step 2: Install the public key on the VPS
Reach the account with your existing method
Use the password, provider console, temporary key, or other access method that currently works. First become the target account; installing a key while logged in as a different user places it in the wrong home directory.
Check the target home directory with printf '%sn' "$HOME" and the account name with id -un. If you are using an administrator account to prepare another user’s access, create or edit that user’s files as that user, or set ownership explicitly afterward.
Create the SSH directory with restrictive permissions
From the target account, run:
mkdir -p ~/.ssh
chmod 700 ~/.sshThe directory should be owned by the login user. If an administrator created it, correct ownership with a command appropriate to your system, such as sudo chown -R user:user /home/user/.ssh, replacing both instances of user with the real account and path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Append the public key without deleting existing keys
Append the public-key line rather than replacing the file:
cat >> ~/.ssh/authorized_keysPaste the complete contents of id_ed25519.pub as one line, press Enter, then end the input (for an interactive shell, press Ctrl-D). Alternatively, use a controlled transfer method that appends the same line. Inspect the result with:
tail -n 1 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keysEach active key must occupy its own line. Do not add quotes, extra line breaks, or the private key. Keep any existing lines unless you have confirmed they are obsolete and have another tested way into the account.
Where sshd looks for authorized keys
The normal per-user path is ~/.ssh/authorized_keys. The documented default also includes ~/.ssh/authorized_keys2, but an administrator can override both locations with the AuthorizedKeysFile setting in the effective daemon configuration. A key placed in the wrong home directory or wrong filename will produce the same symptom as a bad key.
Recommended Free Tools
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
A line may contain options before the key type, followed by base64 key data and a comment. Options can deliberately restrict a key, but do not add them during initial setup unless you understand their effect. Check for accidental wrapping, leading spaces in unusual positions, or a truncated base64 string when troubleshooting.
Step 3: Test a new key-based session
Open a second terminal while the original session remains connected. Specify the private key explicitly:
ssh -i ~/.ssh/id_ed25519 [email protected]Replace user and vps.example with the actual account and host. If the key has a passphrase, the client asks for that passphrase locally. A successful login proves that the server found the public key and that the client offered the matching private key.
If your client has several keys, use an explicit identity or an SSH configuration entry so you know which credential was offered. A successful session using an old agent-loaded key does not prove that the newly installed key works. After login, verify the account with id -un and the host with hostname.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep both sessions open until you have also validated any daemon configuration change. A single successful test followed by closing the original connection can still leave you locked out if a later reload fails.
Step 4: Confirm the effective SSH daemon settings
Allow public-key authentication
The setting that controls acceptance of key authentication is:
PubkeyAuthentication yesThe OpenSSH manual defines this as the switch that allows public-key authentication and lists yes as the default. Ubuntu’s server guidance also tells administrators to ensure it is set to yes. Distribution files can contain included snippets or conditional Match blocks, so inspect the effective configuration rather than relying only on one line in a file.
As an administrator, sshd -T prints the daemon’s effective settings in a form suitable for checking. A conditional block may produce different values for a particular user, source address, or connection pattern; evaluate those conditions before concluding that a global setting applies.
Validate before reloading
After any edit, run the distribution’s configuration test mode. A common OpenSSH command is:
sudo sshd -tNo output generally indicates that the syntax check passed; an error identifies a line that must be corrected before a reload. Use the service-management command provided by your Linux distribution to reload the daemon only after the test succeeds. A reload applies configuration to new connections while allowing the already-open session to remain available.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Step 5: Disable password authentication only when ready
If your policy is key-only access, set:
PasswordAuthentication noValidate the configuration, reload the daemon, and immediately open another connection with the tested private key. Keep the original session until that new connection succeeds.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesPassword and keyboard-interactive authentication are separate methods. The Debian OpenSSH manual lists password, keyboard-interactive, public-key, and other methods independently. Therefore, changing PasswordAuthentication does not by itself describe every route a server might still offer. Review KbdInteractiveAuthentication, PAM behavior, included configuration files, and user-specific Match blocks against your access policy. Do not disable a method merely because a tutorial lists it; understand which recovery and automation workflows depend on it.
Troubleshoot a failed key login
“Permission denied (publickey)”
- Confirm the username. The key may be installed correctly for another account.
- Check that the public-key line on the VPS exactly matches the output of
cat ~/.ssh/id_ed25519.pubon the client. - Verify the server is reading the path you used. Inspect the effective
AuthorizedKeysFilevalue and anyMatchblock. - Check ownership and mode bits: the account should own
~/.sshandauthorized_keys; the directory should normally be mode700and the file mode600. - Make sure the client command points to the intended private key with
-i. A public key can be present while the matching private file is missing, unreadable, or not offered. - Inspect the server’s authentication logs through the distribution’s normal logging facility. They often distinguish an unreadable file, rejected key option, wrong username, or disabled method.
A password prompt still appears
A password prompt does not prove that key authentication is unavailable; it may mean the client tried another method after failing to offer the intended key. Specify -i ~/.ssh/id_ed25519, verify the private file’s permissions, and check that PubkeyAuthentication yes is effective. If keyboard-interactive authentication is enabled, it can also produce a prompt even when ordinary password authentication has been disabled, so inspect both settings and the PAM stack.
The key worked until permissions changed
OpenSSH can reject keys when the home directory, .ssh directory, or authorization file is writable by an unintended user. Restore ownership to the login account, use restrictive modes, and retest from a new terminal. Do not make the file world-writable as a quick experiment; that weakens the account and can obscure the real ownership problem.
You are at risk of lockout
Stop before closing the working connection. Restore the last known-good daemon configuration through the open session or provider console, run the syntax test, and reload. Keep an emergency access procedure documented before enforcing key-only access on production systems.
Managing several administrators and rotating keys
Use one key line per person
Do not distribute one shared private key to a team. Add a separate public-key line for every administrator, with a recognizable comment such as a person’s name and device. Individual lines make audit and revocation practical: removing one line ends that credential without interrupting the others.
Replace a key safely
- Generate a replacement pair on the administrator’s own device and protect its private key with a new passphrase.
- Append the replacement public key to the account’s
authorized_keysfile. - Test a new SSH session using the replacement private key.
- Remove the old public-key line only after the replacement login and any required recovery path have been verified.
- Record which key was removed and keep an emergency access procedure for the next rotation.
Revocation is performed on the server by deleting the corresponding public-key line. Destroying a private key on one device does not remove the public key from a VPS, and deleting a public line does not recover a private key that has already been copied.
File-based keys versus FIDO2-backed SSH keys
Modern OpenSSH documentation includes FIDO key types such as ecdsa-sk and ed25519-sk. These use a compatible FIDO2 USB or NFC security key as hardware-backed protection. They are optional: ordinary Ed25519 files remain a valid choice when the client, backup process, and recovery plan are managed carefully.
| Consideration | File-based Ed25519 key | FIDO-backed *-sk key |
|---|---|---|
| Private-key protection | Encrypted on the client with a passphrase; security depends on the device and its backups. | Uses a hardware security key, reducing exposure of the signing credential on the computer. |
| Portability and backup | Can be copied into an approved encrypted backup and used on another compatible client. | Requires the physical security key; plan a second enrolled key or another recovery route. |
| Physical presence | No touch requirement after the private key is unlocked. | touch-required can require a physical touch; verify-required can require user verification such as a PIN. |
| Client compatibility | Supported broadly by OpenSSH clients that support the selected algorithm. | Requires OpenSSH and operating-system support for the selected FIDO key type plus a compatible USB or NFC device. |
| Recovery | Restore the encrypted private-key backup or install a replacement public key through console access. | Keep a spare enrolled security key or documented console recovery; losing the only token can block login. |
| Rotation and revocation | Append a new public line, test it, then remove the old line. | Use the same server-side line replacement process, while also tracking the physical token that holds the credential. |
For a hardware-backed key, configure the server’s PubkeyAuthOptions deliberately. touch-required requires physical presence, while verify-required requires user verification such as a PIN. Test the complete workflow, including the touch or PIN prompt, from a fresh session before removing another administrator’s access.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Key-only access or mixed authentication?
| Policy | Lockout resilience | Attack surface | Operational requirement |
|---|---|---|---|
| Mixed authentication | Higher tolerance for a lost key because an approved alternate method may remain. | More authentication paths must be monitored and protected. | Document exactly which password, keyboard-interactive, PAM, and public-key methods are intended. |
| Key-only | Lower tolerance for lost keys, broken clients, or incorrect permissions. | Removes password login when all relevant alternate methods are also addressed. | Maintain tested spare keys, provider-console access, rotation procedures, and a second-session verification habit. |
Neither policy is automatically correct for every VPS. The safe sequence is the same: install a key, prove a new session works, inspect the effective daemon configuration, validate syntax, reload, and retain recovery access. Only then should you remove an authentication method.
Quick Recap
Practical completion checklist
- The client has a newly generated key pair and the private key is protected by a strong passphrase.
- Only the public-key line was copied to the intended VPS account.
~/.sshis owned by the account and is not writable by other users;authorized_keysis likewise owned and restricted.- The key appears as one complete line in the server’s effective authorization file.
- A second terminal successfully connected with the explicit private-key path.
PubkeyAuthentication yesis effective for the connection you are testing.- Any
PasswordAuthentication nochange was syntax-tested and reloaded only after the key test. - Keyboard-interactive, PAM, and
Match-block behavior matches the intended policy. - Each administrator has an individual key, and the team has a documented rotation and revocation procedure.
- For FIDO-backed keys, touch or PIN behavior, client compatibility, spare-token availability, and console recovery have all been tested.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
