SSH Key Login on VPS: Creating, Adding, and Disabling Password Authentication

Password-based login is the weakest point in any server's security. Bots continuously brute-force combinations using dictionaries, and even a complex password offers no absolute guarantee. SSH keys solve this problem at a fundamental level: the server only accepts connections from someone who holds the correct private key, and guessing it through brute force is practically impossible. In this guide, we will walk through the entire process — from ordering a server to fully disabling password-based login.

Step 1. Create a VPS on NodexGo

Log in to the NodexGo control panel and click the Create Server button. Choose a location — the real ping from your device to each location is displayed next to it, making it easier to pick the nearest one. Then select a suitable plan and operating system image: for this guide, we recommend Ubuntu 24.04. Set a server name, choose a billing period — 1, 3, 6, or 12 months — and confirm the order. Within a few minutes the server will be ready: the IP address and root password will appear in the panel and will be sent to your email.

Step 2. Connect to the server using a password

Since the SSH key has not been added yet, connect the usual way — using the root password from the email or the control panel. Open a terminal (Terminal on macOS and Linux, PowerShell or Windows Terminal on Windows) and run the following command:

ssh root@your-server-IP

If the server was just created, the terminal will ask whether to trust the host fingerprint on the first connection — type yes. Once you have logged in successfully, you can proceed to creating the keys.

Step 3. Generate an SSH key on your local computer

The key pair must be created on your local computer, not on the server. The private key stays with you; the public key will be copied to the server. The command is the same for Windows (PowerShell 7+ or the built-in OpenSSH), macOS, and Linux:

ssh-keygen -t ed25519 -C "your_email@example.com"

The utility will ask where to save the key — press Enter to use the default path (~/.ssh/id_ed25519 on macOS and Linux, C:\Users\YourUsername\.ssh\id_ed25519 on Windows). It will then offer to set a passphrase — this is an additional layer of protection for the private key, and we recommend not leaving the field empty. Two files will be created as a result: id_ed25519 (the private key — never share it with anyone) and id_ed25519.pub (the public key, which is copied to the server).

Step 4. Add the public key to the server

The fastest method is the ssh-copy-id utility. It will automatically add the public key to the ~/.ssh/authorized_keys file on the server. On macOS and Linux, run the following in your local terminal:

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@your-server-IP

On Windows, ssh-copy-id is not included in the standard OpenSSH package, so use the following command in PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@your-server-IP "cat >> ~/.ssh/authorized_keys"

If SSH access is unavailable or you prefer to add the key manually, open the server card, go to Management, then VNC Access: the server screen will open directly in your browser. Enter the login root, click the Enter Password button in the console — it will type the root password from the server card — and then press Enter. Create the keys directory and open the file:

mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys

On your local computer, copy the contents of the id_ed25519.pub file (a single line starting with ssh-ed25519) and paste it into the console using the Paste button. Save the file (Ctrl+O, Enter, Ctrl+X) and set the correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Step 5. Test the key-based login

Before disabling password login, make sure the key works. Open a new terminal window and connect to the server — without closing the current session. If you set a passphrase, the terminal will prompt you to enter it. A successful login without a request for the root password means the key was added correctly and you can proceed.

ssh root@your-server-IP

Step 6. Disable password-based login

Now we will prevent SSH from accepting passwords — this will protect the server from brute-force attacks. Open the SSH daemon configuration file:

nano /etc/ssh/sshd_config

Find the following directives and set them to the values shown below. If a line is commented out (starts with #), remove the comment character:

PasswordAuthentication no
PermitRootLogin prohibit-password
PubkeyAuthentication yes

On Ubuntu 22.04 and 24.04 there is also the /etc/ssh/sshd_config.d/ directory — settings in it take precedence over the main file. Check that no password login permission remains there:

grep -ri passwordauthentication /etc/ssh/sshd_config.d/

If the command finds a line with PasswordAuthentication yes (most commonly in the file 50-cloud-init.conf), change yes to no in that file.

Save the file (Ctrl+O, then Enter, then Ctrl+X in nano) and restart the SSH daemon for the changes to take effect:

systemctl restart ssh

Do not close the current SSH session. Open a new terminal window and try connecting with the key again — make sure login works. Only after a successful check should you close the old session. If something goes wrong and you lose access, use the VNC web console in the server card: it is independent of SSH and lets you fix the configuration directly in your browser. The restriction applies only to SSH: you can still log in to the console as root using the password from the server card.

Additional security measures

After setting up keys, it makes sense to change the default SSH port from 22 to any other port above 1024 — this will reduce the number of automated scans in your logs. The relevant directive in sshd_config is Port; make sure to open the new port in the firewall first. On Ubuntu 24.04, SSH runs via ssh.socket, so after changing the port run systemctl daemon-reload and systemctl restart ssh.socket. We also recommend installing fail2ban: it automatically blocks IP addresses after several failed login attempts, which is relevant even with password login disabled. The private key should only be stored on trusted devices, with a backup kept in an encrypted storage.

If you work with multiple servers, it is convenient to create a ~/.ssh/config file on your local computer and define aliases for each host with the appropriate key and username specified. This eliminates the need to type the full address and flags every time.

Conclusion

Switching from password authentication to SSH keys is one of the first things you should do right after receiving a new server. It takes no more than ten minutes but dramatically improves security: brute-force attacks become pointless, and an accidental password leak no longer threatens access to the machine. If you have not yet rented a VPS, do so on NodexGo — choose a plan, select the Ubuntu 24.04 image, and set up keys immediately using this guide.