SSH keys

A key is a pair of files: the private one stays with you, the public one sits on the server. Unlike a password, a key practically cannot be brute-forced, and you type nothing at login.

Creating a key

Linux / macOS
Windows

Key – in the terminal on your own computer:
ssh-keygen -t ed25519 -C "lumi-vps"
At the prompts:
- Path – press Enter. Never share the private key ~/.ssh/id_ed25519, the public ~/.ssh/id_ed25519.pub goes on the server.
- Passphrase – a password on the key itself, set one: a stolen file is useless without it. To avoid typing it every time: ssh-add ~/.ssh/id_ed25519.
Key to the server – replace IP with the Server IP from the card (My servers → server). The command asks for the root password once:
ssh-copy-id root@IP
No ssh-copy-id – print the key with cat ~/.ssh/id_ed25519.pub and add it manually as in the section below.

Key – in PowerShell, OpenSSH is built into Windows 10/11:
ssh-keygen -t ed25519 -C "lumi-vps"
Press Enter at the path question. The keys land in C:\Users\NAME\.ssh\: id_ed25519 is private, id_ed25519.pub is public.
Key line – print it and add it to the server manually as in the section below:
type $env:USERPROFILE\.ssh\id_ed25519.pub

PuTTY – the key is made in PuTTYgen: type EdDSA (Ed25519), Generate, then Save private key (a .ppk file). Add the line from the field at the top of the window to the server manually, and set the .ppk file in PuTTY: Connection → SSH → Auth → Credentials → Private key file.

Manual setup

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "PASTE_KEY_HERE" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

PASTE_KEY_HERE – the whole public key line.

Check

Connect again:

ssh root@IP

Logged in without the server password – the key works. If you set a passphrase, you are asked for it: that is the password for the key on your computer, not for the server.

Disabling the password

Once key login works, you can turn the password off: there is nothing left to brute-force.

Check key login first. Turn the password off too early and you lose access to the server. If that happens, log in through Console on the server card, not every server has it.

SSH settings – open them on the server:
nano /etc/ssh/sshd_config
No password – find the PasswordAuthentication line, remove the leading # if there is one, and make it:
PasswordAuthentication no
Save: Ctrl+O, Enter, Ctrl+X. Also look in /etc/ssh/sshd_config.d/: a PasswordAuthentication yes line in files there overrides the main file, change it to no.
Restart SSH – the current connection stays open:
systemctl restart ssh
On AlmaLinux, Rocky, and CentOS the service is called sshd. Check the result with sshd -T | grep -i passwordauthentication: it should say passwordauthentication no. Before closing the connection, check key login in a second window.

Next: Server hardening, Firewall.

Basics

Setup

Protection & issues

Software & services

Creating a key

Manual setup

Check

Disabling the password

​Creating a key

​Manual setup

​Check

​Disabling the password

Creating a key

Manual setup

Check

Disabling the password