How to Set Up SSH Keys for Your Server (Step by Step)

Password logins are the number one way servers get compromised. Bots hammer port 22 with millions of guesses a day, and a weak password eventually gives. SSH keys solve this for good: instead of something you type, you prove your identity with a key pair that is effectively impossible to guess. Here is the whole process, start to finish.

How SSH keys work

You generate two linked files: a private key that stays on your computer, and a public key you put on the server. The server challenges anyone connecting to prove they hold the matching private key. No password is sent over the wire, and there is nothing to brute-force.

Step 1: Generate a key pair

On your own machine (Mac, Linux, or Windows PowerShell), run:

ssh-keygen -t ed25519 -C "you@example.com"

Press Enter to accept the default location. You can set a passphrase for extra protection — it encrypts the private key so a stolen laptop does not hand over server access. Ed25519 is the modern, fast, secure choice; use -t rsa -b 4096 only if you need to support very old systems.

Step 2: Copy the public key to your server

The easy way:

ssh-copy-id root@YOUR_SERVER_IP

That appends your public key to ~/.ssh/authorized_keys on the server. If ssh-copy-id is not available, paste the contents of ~/.ssh/id_ed25519.pub into that file manually.

Step 3: Test the key login

Open a new terminal and run ssh root@YOUR_SERVER_IP. You should get in without typing a password (just the key passphrase, if you set one). Do not close your existing session until this works — that is your safety net.

Step 4: Disable password authentication

Once keys work, lock the door behind you. Edit /etc/ssh/sshd_config and set:

PasswordAuthentication no
PermitRootLogin prohibit-password

Then reload SSH with sudo systemctl restart sshd. Brute-force attacks against your server are now pointless.

Common gotchas

• Permissions matter. SSH ignores keys if ~/.ssh is 700 and authorized_keys is 600. Fix with chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys.
• Use a non-root user. Create a sudo user and put your key there too, so you are not relying on root day to day.
• Lost your key? Use your provider's console/VNC to add a new public key, or reinstall.

Next steps

Keys are step one of hardening. Add a firewall and fail2ban next — our 12-step Linux VPS security guide walks through the rest. Every Volt Serv Linux VPS gives you full root access to set this up, and you can confirm which ports are reachable with our port checker.