How to Set Up SSH Key Authentication and Disable Passwords

Password logins are the weakest link on most servers — they get guessed, reused, and leaked. SSH keys replace them with a cryptographic pair that is effectively impossible to brute-force. By the end of this guide you'll log in without a password and have password authentication switched off entirely.

How SSH keys work

An SSH key is two files: a private key that never leaves your machine, and a public key you copy to the server. The server encrypts a challenge with your public key; only your private key can answer it. No secret travels over the wire, so there's nothing to intercept or guess.

Step 1: generate a key pair

On your local machine (not the server), create a modern Ed25519 key:

ssh-keygen -t ed25519 -C "you@example.com"

Press Enter to accept the default path (~/.ssh/id_ed25519). When prompted for a passphrase, use one — it encrypts the private key at rest, so a stolen laptop doesn't hand over your servers. If you need compatibility with very old systems, use ssh-keygen -t rsa -b 4096 instead.

Step 2: copy the public key to your VPS

The easiest way is ssh-copy-id, which appends your key to the server's ~/.ssh/authorized_keys:

ssh-copy-id deploy@your-server-ip

If ssh-copy-id isn't available (some Windows setups), do it manually:

cat ~/.ssh/id_ed25519.pub | ssh deploy@your-server-ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

{{SCREENSHOT}}

Step 3: test the key login

Open a new terminal and connect:

ssh deploy@your-server-ip

You should be asked for your key's passphrase (not the server password), or logged straight in if you loaded the key into an agent. If this works, you're ready to disable passwords. If you're new to connecting, our connect to a VPS via SSH guide covers the basics.

Step 4: disable password authentication

Edit /etc/ssh/sshd_config on the server:

PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
UsePAM yes

Validate and reload — never skip the test:

sudo sshd -t && sudo systemctl reload ssh

Keep your working session open and confirm a fresh login still succeeds before closing anything.

Permissions matter

SSH silently ignores keys if file permissions are too loose. On the server:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Managing multiple keys and hosts

A per-host config file makes life easier. In ~/.ssh/config on your local machine:

Host myvps
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    Port 22

Now ssh myvps just works. Use ssh-add ~/.ssh/id_ed25519 to load the key into your agent so you only type the passphrase once per session.

Where this fits in your hardening

Key auth is step one of locking down SSH. Follow it with the full harden SSH on a Linux VPS checklist, disable root login, and for high-value servers add two-factor authentication to SSH.

Using SSH keys from Windows

Windows 10 and 11 include OpenSSH, so the commands above work in PowerShell exactly as on Linux. Generate a key with ssh-keygen -t ed25519, and it lands in C:\Users\you\.ssh. To copy it to a server without ssh-copy-id (which Windows lacks), pipe it over SSH:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh deploy@your-server-ip "cat >> ~/.ssh/authorized_keys"

If you prefer PuTTY, use PuTTYgen to create the pair, save the private key as a .ppk, and load it in Pageant (PuTTY's agent) so you don't retype the passphrase. Modern Windows users are usually better served by the built-in OpenSSH client and Windows Terminal, which behave identically to macOS and Linux.

Rotating and revoking keys

Keys aren't set-and-forget. When a laptop is retired, a contractor leaves, or you simply want fresh credentials, you revoke a key by removing its line from ~/.ssh/authorized_keys on every server. Because that's tedious to do by hand across many machines, keep the file under configuration management (Ansible, a simple deploy script) so adding or removing a key is a one-line change applied everywhere.

Audit what's currently trusted at any time:

cat ~/.ssh/authorized_keys

Each line is one authorised key, with an optional comment at the end identifying its owner — which is exactly why the -C "you@example.com" comment at generation time matters. A file full of anonymous keys is impossible to audit; a file where every key names a person or machine is trivial to keep clean. Review it periodically and remove anything you can't account for, treating an unexplained key as a potential compromise.

FAQ

What if I lose my private key?

You lose access via that key. This is why you keep a second authenticated user or console access. Most hosts, including Nxeon, give you a web console so you can add a new key even if you're locked out of SSH.

Ed25519 or RSA — which should I use?

Ed25519 is smaller, faster, and secure by modern standards. Use it unless you must support an ancient client, in which case use RSA 4096.

Can I use the same key on multiple servers?

Yes — the same public key can go on many servers. Just protect the single private key well with a passphrase.

Do I still need a firewall if I use keys?

Absolutely. Keys secure authentication; a firewall controls which ports are reachable at all. Set up UFW too.

The five-step recap

To go from password logins to key-only in one sitting:

1. Generate an Ed25519 key with a passphrase: ssh-keygen -t ed25519.
2. Copy the public key to the server: ssh-copy-id user@host.
3. Test the key login in a fresh terminal — confirm it works before changing anything.
4. Disable passwords by setting PasswordAuthentication no, then sudo sshd -t && sudo systemctl reload ssh.
5. Verify you can still log in, and that password logins are now refused.

Then fix permissions (chmod 700 ~/.ssh, chmod 600 authorized_keys) and set up a ~/.ssh/config entry so connecting is a single short command. Store your private key safely and back up the ability to regain access — a second key or your provider's console — and you've closed the most-attacked door on your server for good.

Key-based login is the biggest single security win you can make on a server. Ready to build on a host with full root access and a rescue console? Explore Nxeon VPS plans and our security page.