How to set up SSH keys

Quick answer: Generate a key pair on your computer with ssh-keygen -t ed25519, copy the public key to the server with ssh-copy-id root@YOUR_SERVER_IP, and you can log in without a password. Keys are both more convenient and far more secure than passwords.

Overview

An SSH key pair is a private key (stays on your computer, never shared) and a public key (goes on the server). Login succeeds only when they match — brute-forcing a password becomes useless. This is the single best security upgrade for any VPS.

Before you start

• Working password SSH access (you need one last password login to install the key).
• OpenSSH on your computer (built into Windows 10/11, macOS and Linux).

Step-by-step guide

1. On your computer, generate a modern key:

   ssh-keygen -t ed25519 -C "[email protected]"

   Accept the default path; set a passphrase (recommended).
2. Copy the public key to the server:

   ssh-copy-id [email protected]

   No ssh-copy-id on Windows? Use:

   type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh [email protected] "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

3. Test the key login:

   ssh [email protected]

   It should connect without asking for the server password (only your key passphrase, if set).
4. Optional but recommended — disable password logins once keys work (details in securing SSH access):

   nano /etc/ssh/sshd_config
   # set: PasswordAuthentication no
   systemctl restart sshd

Common issues

• Still asked for a password? Check permissions on the server: chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys.
• Locked out after disabling passwords? Use the KVM Console on the service page to re-enable PasswordAuthentication.
• Multiple devices? Generate a key per device and append each public key as a new line in authorized_keys.

When to contact support

If you've lost both the key and password access, open a support ticket — after verification we'll help restore access via console or password reset.

Frequently asked questions

Which key type should I use?

Use ed25519 — it is the modern default: fast, secure and with pleasantly short keys. RSA 4096 remains a safe fallback only when you must connect to very old systems that lack ed25519 support.

Can I use the same key from several devices?

Better to generate one key per device and add each public key as a separate line in authorized_keys — revoking a lost laptop is then easy.

What if I lose my private key?

Use password login (if still enabled) or the KVM Console to add a new public key. Keep a backup access path before disabling passwords.

Related articles

• How to secure SSH access
• How to secure your VPS after deployment
• How to reset VPS root password
• How to connect to VPS via SSH

Need a hand? Contact Cloud2Y support →