What Is an SSH Key? Secure VPS Login Without a Password

SSH key authentication uses a private key on your computer and a matching public key on the server. The private key proves ownership without sending a reusable password over the connection.

Generate a key

Ed25519 is a good modern default:

ssh-keygen -t ed25519 -C "my-vps"

In Windows PowerShell, the same OpenSSH command works when the Windows OpenSSH client is installed. Accept the default path or choose a named key. Protect it with a passphrase.

The files are normally:

• private key: ~/.ssh/id_ed25519;
• public key: ~/.ssh/id_ed25519.pub.

Share only the .pub file. Never paste the private key into GitHub issues, chat, or server configuration.

Add the public key to the VPS

If password login is still enabled, use:

ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@203.0.113.10

On Windows or when ssh-copy-id is unavailable, append the public key to the server user’s ~/.ssh/authorized_keys through your provider’s console or an existing session.

The server should have:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R "$USER":"$USER" ~/.ssh

Test before disabling passwords

Open a new terminal and use the key explicitly:

ssh -i ~/.ssh/id_ed25519 deploy@203.0.113.10

Keep the original session open until the new login works. Only then consider PasswordAuthentication no and PermitRootLogin no in sshd_config; validate with sshd -t before reloading SSH.

Use an SSH config alias

Create ~/.ssh/config:

Host my-vps
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Then connect with:

ssh my-vps

IdentitiesOnly yes prevents an SSH agent with many keys from offering unrelated identities.

Use ssh-agent for passphrases

An agent can keep the decrypted key available for the current session:

ssh-add ~/.ssh/id_ed25519
ssh-add -l

Prefer the operating system’s protected credential store where available.

Troubleshooting

• Permission denied (publickey): confirm the user, key path, and authorized_keys permissions.
• The server ignores the key: check PubkeyAuthentication and the SSH service log.
• Too many authentication failures: use IdentitiesOnly yes or ssh -o IdentitiesOnly=yes -i ....
• Host key has changed: verify the server fingerprint before modifying known_hosts.

If a private key is lost, create a new key pair and add its public key through an existing session or the provider console. If a private key may have leaked, remove its public key from every server and rotate related credentials immediately.