Create an SSH key and turn off password login
With a key you sign in to your VPS without a password. Here is how to create it, add it in your account and lock the server down.
An SSH key replaces the password when you sign in to your server. It is practically impossible to guess, and there is nothing to remember. In this guide you create a key, put it on your VPS and then turn off password login.
Create the key
All you need is a terminal: PowerShell on Windows, the normal terminal on macOS and Linux. Create an Ed25519 key:
ssh-keygen -t ed25519 -C "laptop"
Confirm the suggested location with Enter and set a passphrase. It protects the key if someone gets hold of your computer. Afterwards there are two files in the .ssh folder of your home directory:
| File | Content |
|---|---|
id_ed25519 |
private key, stays on your computer and is never shared |
id_ed25519.pub |
public key, goes onto the server |
Show the public key like this:
cat ~/.ssh/id_ed25519.pub
Add the key in your account
- Open Account → SSH keys.
- Enter a label such as "Laptop" and paste the content of
id_ed25519.pub. - Click Add key.
From now on you can select the key with every new order, and it is put on the server during setup.
On a server that is already running
Open the server and go to the Access tab. Under "SSH keys on the server" pick the key from your account and click Deploy. This works while the server is running and the QEMU guest agent is installed. If it is missing, the tab shows you the command to install it.
You can also do it the classic way from your computer:
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@10.0.0.25
Sign in and test
ssh root@10.0.0.25
If you are only asked for your key's passphrase and not for the server password, it works.
Turn off password login
Only turn off passwords once signing in with the key works reliably. The easiest way is in your account: set Access → Password login (SSH) to "Off".
By hand on the server:
sudo sed -i 's/^#\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart ssh
Keep your current terminal open and test the login in a second window. If something goes wrong, you can still undo everything in the first one. And if you ever lock yourself out: the Console tab always gets you onto your server.
Checklist
- Key created with a passphrase
- Public key added to the account and put on the server
- Login with the key tested
- Password login turned off
For the community
Know your stuff? Write a guide.
Share what you know: we review every submitted guide, publish it under your name and say thank you with credit for your services.