How to Set Up SSH Keys and Turn Off Password Login

A password can be guessed, phished or reused from a leak. An SSH key cannot: it is a 256-bit secret that never leaves your computer, and the server only ever sees a signature. Setting it up takes five minutes and ends password guessing against your server permanently.

1. Generate a key on your machine

macOS and Linux — in a terminal:

ssh-keygen -t ed25519 -C "you@example.com"

Windows 10/11 — the same command works in PowerShell or Windows Terminal; OpenSSH is built in.

Accept the default file location (~/.ssh/id_ed25519). Set a passphrase — it encrypts the private key on disk, so a stolen laptop does not mean a stolen server. You will be asked for it once per session, and an agent remembers it.

ed25519 is the modern choice: shorter, faster and at least as secure as a 4096-bit RSA key. Use RSA only if a very old server refuses ed25519.

You now have two files: id_ed25519 (private — never share, never copy to a server) and id_ed25519.pub (public — this is what goes on servers).

2. Put the public key on the server

The simplest way:

ssh-copy-id deploy@203.0.113.10

It logs in with your password one last time and appends the public key to ~/.ssh/authorized_keys. On Windows without ssh-copy-id:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh deploy@203.0.113.10 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys"

In Plesk, you can also paste the public key under Websites & Domains → Web Hosting Access → SSH keys for the subscription's system user.

3. Test before changing anything

Open a new terminal and connect:

ssh deploy@203.0.113.10

If it logs you in without asking for the account password (only your key passphrase, if you set one), the key works. If it still asks for the password, on the server check the permissions — SSH refuses keys in a directory that is group- or world-writable:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
ls -la ~/.ssh

Do not go further until this works.

4. Disable passwords

On the server:

sudo nano /etc/ssh/sshd_config

Set these three lines (uncomment them if needed):

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no

Ubuntu may ship a file in /etc/ssh/sshd_config.d/ that re-enables passwords; check:

grep -r PasswordAuthentication /etc/ssh/sshd_config.d/

Validate and restart — keep your current session open while you do:

sudo sshd -t && sudo systemctl restart ssh    # sshd on AlmaLinux / Rocky

From a third terminal, confirm passwords are refused:

ssh -o PubkeyAuthentication=no deploy@203.0.113.10
# Permission denied (publickey).

5. Make it convenient

An SSH config file saves typing and lets you use different keys per server. In ~/.ssh/config on your machine:

Host web
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/id_ed25519

Now ssh web connects. On macOS, add UseKeychain yes under the host and the passphrase is stored in Keychain. On Windows, start the agent once: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent; ssh-add.

Several people, several keys

authorized_keys is one public key per line. Add each person's key on its own line, and remove the line when they leave — that is offboarding done. Keep a comment on each line (the -C you set when generating) so you know whose key is whose.

If you lose the private key

You cannot recover it, by design. Log in through your provider's console (VPSPioneer: the client area, or a ticket on a managed VPS), add a new public key to authorized_keys, and remove the old line. This is also why the console exists: it works without SSH at all.

With keys in place and passwords off, the next two steps in hardening a VPS — a firewall and Fail2ban — turn the ten thousand failed logins a day in your logs into zero.