Security guide

How to Set Up SSH Keys and Turn Off Password Logins

By Gander Web · Published 16 October 2026 · 3 min read

An SSH key pair has two halves. The private key stays on your computer; the public key goes on the server. Bots guessing passwords get nowhere against a server that only accepts keys. Windows 10 and 11, macOS and Linux all include the OpenSSH tools used below, so there's nothing to install.

Create the key

Open PowerShell on Windows, or Terminal on macOS and Linux, and run:

ssh-keygen -t ed25519 -C "your-name-laptop"

Press Enter to accept the default location, then set a passphrase. It protects the key if your laptop is lost or stolen, and with an agent (below) you type it once per session. You now have two files in the .ssh folder in your home folder:

• id_ed25519 is the private key. Never copy it anywhere or send it to anyone.
• id_ed25519.pub is the public key, which goes on servers.

Ed25519 keys are short, fast and supported by every current version of OpenSSH. Use -t rsa -b 4096 only if you need to log in to a very old system.

Copy the public key to the server

On macOS and Linux:

ssh-copy-id user@your-vps-ip

Windows doesn't have ssh-copy-id, so send the key across in PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@your-vps-ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Both ask for the account's password one last time.

Test the key

ssh user@your-vps-ip

You should get in without the account password (you'll be asked for the key's passphrase instead, if you set one). Keep this session open during the next step, so you have a way back in if something goes wrong.

Turn off password logins

Create a new settings file rather than editing the main one:

sudo nano /etc/ssh/sshd_config.d/00-hardening.conf

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password

SSH uses the first value it reads for each setting, and reads the files in sshd_config.d in name order. Cloud images often include 50-cloud-init.conf with PasswordAuthentication yes, so starting your file's name with 00- makes sure your setting wins. prohibit-password lets root log in with a key only; if you log in as a normal user with sudo, use no.

Check the configuration, restart SSH, and confirm the settings it's using:

sudo sshd -t
sudo systemctl restart ssh
sudo sshd -T | grep -E 'passwordauthentication|permitrootlogin'

On AlmaLinux and Rocky the service is called sshd, so restart it with sudo systemctl restart sshd. Open a second terminal and log in again before you close the first one.

Stop typing the passphrase every time

An SSH agent holds the unlocked key for your session. On macOS, add this to ~/.ssh/config:

Host *
    AddKeysToAgent yes
    UseKeychain yes

On Windows, run PowerShell as administrator once to start the agent automatically, then add the key:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

The same ~/.ssh/config file can give each server a short name, so ssh myvps replaces the full command:

Host myvps
    HostName 203.0.113.50
    User deploy
    IdentityFile ~/.ssh/id_ed25519

PuTTY and FileZilla

PuTTY uses its own key format. Open PuTTYgen, choose Conversions > Import key, load id_ed25519 and save it as a .ppk file. FileZilla can use the key for SFTP: add it under Edit > Settings > Connection > SFTP.

Questions

Related guides

Sources

1. sshd_config manual (OpenSSH)
2. ssh-keygen manual (OpenSSH)

Commands are for Ubuntu 24.04, Debian 12 and AlmaLinux 9, as of 16 October 2026. If something here no longer matches what you see, tell us and we'll update it.