How to Create and Use SSH Keys to Connect to Your Server

Introduction

SSH keys are the most secure method to access a server. Unlike passwords, they can’t be guessed with brute force attacks, and they also let you connect without typing the password every time.

If you’re going to manage a VPS, configuring SSH keys is the first thing you should do. In this article you’ll see how to create them, copy them to the server and disable password access.

What an SSH key is

An SSH key consists of two files that work like a padlock and its key:

• Private key: stays on your computer. It’s the key. Never share it with anyone.
• Public key: gets copied to the server. It’s the padlock. It can be shared without problem.

When you connect, your computer proves it has the private key that matches the server’s public padlock. If they match, you get in. If not, the connection is rejected.

[Imagen sugerida: diagram of how the public key and private key work]

Unlike a password, the private key never travels over the network. That’s why it’s impossible to intercept, no matter how much someone listens to your connection.

Step 1: Create the SSH key on your computer

Open the terminal on your computer (not on the server):

• Windows: PowerShell or Command Prompt.
• Linux/Mac: Terminal.

Generate a key with the ed25519 algorithm (the most modern and recommended):

ssh-keygen -t ed25519

If your system is very old and doesn’t support ed25519, use RSA: ssh-keygen -t rsa -b 4096

It will ask you three questions:

1. Where to save it: press Enter to leave it in the default location (~/.ssh/id_ed25519).
2. Optional passphrase: an extra password that protects the key. Recommended but optional. If you set one, it will ask for it every time you use the key.
3. Confirm passphrase: repeat it.

Two files are created:

• ~/.ssh/id_ed25519 → private key (don’t share it).
• ~/.ssh/id_ed25519.pub → public key (the one you copy to the server).

Step 2: Copy the public key to the server

The simplest way is with ssh-copy-id:

ssh-copy-id root@your-server-ip

It will ask for the server password one last time. From then on, the key is copied.

If your system doesn’t have ssh-copy-id (like some Windows versions), you can do it manually:

type ~/.ssh/id_ed25519.pub | ssh root@your-server-ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Step 3: Check that the key works

Connect to the server:

ssh root@your-server-ip

If you configured a passphrase for the key, it will ask for it. If not, it should log in without asking for the server password. If so, the SSH key is working.

Don’t proceed to step 4 until you confirm the key works. If you disable the password without having confirmed the key, you’ll be locked out.

Step 4: Disable password access

Once you confirm the key works, disable password access for maximum security.

On the server, edit the SSH configuration:

nano /etc/ssh/sshd_config

Find and change these lines:

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password

• PasswordAuthentication no: disables password access.
• PubkeyAuthentication yes: enables key access.
• PermitRootLogin prohibit-password: allows root only with a key, not with a password.

Save and restart SSH:

systemctl restart ssh

[Imagen sugerida: screenshot of the sshd_config file with the correct options]

How to manage several keys or servers

Several servers, one computer

Your computer can have several keys and connect to several servers. To avoid typing the IP and port every time, create a configuration file:

nano ~/.ssh/config

Host myserver
    HostName 192.168.1.100
    User root
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

From then on, connect with:

ssh myserver

Several authorized users

If you want several people to access the same server, copy each person’s public key to the server’s ~/.ssh/authorized_keys file. Each line is one key.

Useful tips

• Use ed25519, not RSA. It’s more secure and shorter.
• Protect the private key with a passphrase. If someone steals your computer, they won’t be able to use the key without the passphrase.
• Keep a backup of your private key. If you lose it, you’ll have to generate a new one.
• Never share the private key. The public key can be shared; the private key, never.
• Revoke old keys. If someone no longer needs access, delete their key from authorized_keys.

Common problems

It still asks for the server password

The public key isn’t properly copied or the permissions are incorrect. On the server, check:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

And verify the public key is in ~/.ssh/authorized_keys (you can view it with cat ~/.ssh/authorized_keys).

Permission denied (publickey)

After disabling the password, this error means the key isn’t recognized. Check that you copied the correct key and that the .ssh permissions are adequate.

I lost my private key

You’ll have to log in via recovery console (if your provider offers one) or ask support to reset it. Once inside, copy a new key.

I want to use the same key on two computers

Copy the two files (id_ed25519 and id_ed25519.pub) to the second computer, in the ~/.ssh/ folder. Set the correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519

The passphrase bothers me

You can remove it, but it’s less secure. If you remove it, anyone who accesses your computer will be able to enter the server. Better use an SSH agent (ssh-agent) that remembers the passphrase during the session.

Frequently asked questions

Are SSH keys more secure than passwords?

Yes, much more. A 256-bit key (ed25519) is mathematically impossible to guess, while a password can be guessed with brute force.

Do I need a different key for each server?

It’s not mandatory, but recommended. This way, if one key is compromised, it doesn’t affect all your servers.

Is the key’s passphrase mandatory?

No, but highly recommended. It protects the private key if someone accesses your computer.

Can I use the same key on Windows, Linux and Mac?

Yes. The private key is a text file you can copy between systems. Just make sure to set the correct permissions.

What if someone steals my private key?

If it has a passphrase, they won’t be able to use it without guessing it. If it doesn’t have a passphrase, they’ll be able to enter your server. Generate a new key and delete the compromised one from the server’s authorized_keys.

Secure access, without passwords

SSH keys are the security standard for accessing servers. Once configured, you connect with one command, without passwords, and with a level of security impossible to achieve with passwords.

If you have a miHosting managed VPS, we configure and manage SSH keys for you. If you have a self-managed VPS, this guide serves to protect your server from day one. Open a ticket from your client panel if you need help.