Set Up SSH Key Authentication for Your VPS

How key authentication works

You generate two files. The private key stays on your computer and never leaves it. The public key is copied to every server you want to reach, into ~/.ssh/authorized_keys. When you connect, the server sends a challenge that only the matching private key can answer. Nothing secret crosses the network, so there is nothing to intercept or brute-force.

1. Generate a key

Ed25519 keys are short, fast and secure, and every current SSH server supports them. The same command works in macOS Terminal, Linux and Windows PowerShell:

ssh-keygen -t ed25519 -C "you@laptop"

Accept the default location (~/.ssh/id_ed25519) and set a passphrase. The passphrase encrypts the private key on disk, so a stolen laptop does not mean stolen servers. An SSH agent remembers it for your session so you are not prompted every time.

2. Copy the public key to the server

On macOS and Linux:

ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]

Windows does not ship ssh-copy-id, so pipe the key over in PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh [email protected] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

You can also paste a public key into the customer portal when you deploy a server, so it is installed for root on first boot.

3. Test the key

ssh -i ~/.ssh/id_ed25519 [email protected]

If you were asked for the key passphrase rather than the account password, it worked.

4. Add a shortcut in ~/.ssh/config

Typing addresses gets old quickly. Create or edit ~/.ssh/config on your computer:

Host web1
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ServerAliveInterval 30

Now ssh web1 connects, and scp file.tar.gz web1: and rsync -av site/ web1:/var/www/site/ use the same settings.

5. Use an agent

On macOS add UseKeychain yes and AddKeysToAgent yes under Host *. On Windows, enable the OpenSSH Authentication Agent service once:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

On Linux desktops the agent usually runs already; ssh-add loads the key.

6. Disable password logins

Only do this after step 3 succeeds. On the server:

sudo tee /etc/ssh/sshd_config.d/10-keys-only.conf >/dev/null <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
sudo sshd -t && (sudo systemctl reload ssh || sudo systemctl reload sshd)

Confirm from another terminal that ssh -o PubkeyAuthentication=no [email protected] is now refused.

Managing keys over time

• Use one key per device, so losing a laptop means removing one line from authorized_keys, not rotating everything.
• Remove keys for people who leave a project the same day.
• Back up your private key securely, or make sure you can still reach servers through the VeloxMedia browser console if it is lost.
• For automation such as CI deploys, create a separate key without a passphrase, restricted to a dedicated user.