SSH key setup for VPS: the complete guide

Why SSH keys instead of passwords?

SSH passwords are vulnerable. Attackers run millions of brute-force login attempts every hour. SSH keys eliminate this threat entirely:

Generating your first SSH key pair

SSH keys use public-key cryptography. You generate a pair: a public key (goes on the server) and a private key (stays on your computer, never shared). Generate the key on your local machine:

ssh-keygen -t ed25519 -C "your-email@example.com"

You'll be prompted for:

Adding your key to the VPS

You have two options: use the automatic ssh-copy-id tool (easiest), or copy manually (needed if your host blocks ssh-copy-id).

Option 1: Using ssh-copy-id (recommended)

The easiest way — you still need to log in with a password one more time:

ssh-copy-id -i ~/.ssh/id_ed25519 root@your-vps-ip

Replace root with your username and your-vps-ip with your server's IP address. Enter your password when prompted. Done — your public key is now on the server!

Option 2: Manual copy (if ssh-copy-id doesn't work)

Step 1: Get your public key content:

cat ~/.ssh/id_ed25519.pub

This outputs a long string starting with ssh-ed25519. Copy the entire output.

Step 2: SSH into your server (one last time with password) and add the key:

ssh root@your-vps-ip

# On the server, create the .ssh directory if it doesn't exist
mkdir -p ~/.ssh
chmod 700 ~/.ssh

# Add your public key to authorized_keys
echo "paste-your-public-key-here" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Exit the server
exit

The file must be called authorized_keys (in the ~/.ssh directory) and have exact permissions (700 for directory, 600 for file).

Test SSH key login

After adding your key, try logging in without a password:

ssh -i ~/.ssh/id_ed25519 root@your-vps-ip

If you used the default location and filename, you can simplify this to:

ssh root@your-vps-ip

SSH automatically tries keys in ~/.ssh/id_*. If it works, you're done! If not, check the troubleshooting section below.

Disable password authentication

Once your key is working, disable password logins to close the door on brute-force attacks. SSH into your server:

ssh root@your-vps-ip

# Open the SSH config
sudo nano /etc/ssh/sshd_config

Find and modify these lines (search with Ctrl+W in nano):

# Change these lines:
PasswordAuthentication yes    → PasswordAuthentication no
PubkeyAuthentication no       → PubkeyAuthentication yes
PermitRootLogin yes           → PermitRootLogin prohibit-password  # or no

# Make sure this is uncommented:
PubkeyAuthentication yes

Save with Ctrl+X, then Y, then Enter. Restart SSH:

sudo systemctl restart sshd

Managing multiple SSH keys

If you have multiple servers or accounts, use an SSH config file to manage keys. Create or edit ~/.ssh/config:

Host my-vps
  HostName your-vps-ip
  User root
  IdentityFile ~/.ssh/id_ed25519
  Port 22

Host production
  HostName prod.example.com
  User deploy
  IdentityFile ~/.ssh/id_production
  Port 2222

Host github
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_github

Now you can connect simply:

ssh my-vps              # Uses the first key
ssh production          # Uses the production key
ssh github              # Uses the GitHub key

Make sure the permissions are correct:

chmod 600 ~/.ssh/config

Connecting DeployWise with SSH keys

DeployWise uses SSH keys to connect to your VPS and manage deployments. Here's how to add your server to DeployWise:

Troubleshooting SSH key issues

Best practices checklist