How to Set Up SSH Keys on Ubuntu Server

Authenticating to your Linux Virtual Private Server (VPS) using standard passwords leaves your system vulnerable to automated dictionary and brute-force attacks. SSH Keys provide a modern, cryptographically secure alternative by using public-key cryptography. With SSH keys enabled, you can log in instantly without typing a password while ensuring that only authorized devices possessing the private key can access your server.

Whether you are running Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, or Ubuntu 20.04 LTS, configuring SSH key authentication is one of the most essential security measures you can implement on your Aveshost VPS.

In this step-by-step tutorial, you will learn how to generate high-security ED25519 and RSA SSH key pairs, upload your public key to Ubuntu, test key authentication, and safely disable password login.

Prerequisites

• An active Linux VPS running Ubuntu (26.04, 24.04, 22.04, or 20.04 LTS).
• SSH access to your server (see our guide on How to Log in and Access Ubuntu Server via SSH).
• A local computer running Windows 10/11, macOS, or Linux.

Step-by-Step Guide: How to Set Up SSH Keys on Ubuntu

Step 1: Generate an SSH Key Pair on Your Local Computer

Open your local terminal (PowerShell/Command Prompt on Windows, Terminal on macOS/Linux) and run the key generator command. We strongly recommend using the modern ED25519 algorithm for superior speed and security:

# Recommended: ED25519 Algorithm
ssh-keygen -t ed25519 -C "[email protected]"

# Alternative: 4096-bit RSA Algorithm (for legacy compatibility)
ssh-keygen -t rsa -b 4096 -C "[email protected]"

Prompts Explained:

1. File Location: Press ENTER to accept the default file location (~/.ssh/id_ed25519).
2. Passphrase: (Optional but recommended) Enter a secure passphrase to encrypt your private key on your local machine, then press ENTER.

This creates two files in your local ~/.ssh/ folder:

• id_ed25519: Your Private Key (Keep this file strictly confidential on your computer!).
• id_ed25519.pub: Your Public Key (This is what you upload to your Ubuntu server).

Step 2: Copy the Public Key to Your Ubuntu Server

Choose either of the two methods below to copy your public key to your server:

Method A: Using ssh-copy-id (Recommended for macOS, Linux, and Windows Git Bash)

ssh-copy-id username@YOUR_SERVER_IP
# Example for root:
ssh-copy-id root@YOUR_SERVER_IP

Enter your server password when prompted. The utility will automatically append your public key to the remote server’s ~/.ssh/authorized_keys file with the correct file permissions.

Method B: Manual Installation via SSH (Works on all systems including Windows PowerShell)

1. Display your public key content on your local computer:

   # Windows PowerShell:
   cat ~/.ssh/id_ed25519.pub
   
   # macOS / Linux:
   cat ~/.ssh/id_ed25519.pub

2. Copy the entire output starting with ssh-ed25519 AAAAC3NzaC1lZDI1NTE5....
3. Connect to your Ubuntu server via SSH:

   ssh username@YOUR_SERVER_IP

4. Create the .ssh directory and authorized_keys file on the server:

   mkdir -p ~/.ssh
   chmod 700 ~/.ssh
   nano ~/.ssh/authorized_keys

5. Paste your public key onto a new line in authorized_keys, then press CTRL + O, ENTER, and CTRL + X to save.
6. Lock down permissions on the authorized_keys file:

   chmod 600 ~/.ssh/authorized_keys

Step 3: Test SSH Key Authentication

Open a NEW terminal window on your local computer (without closing your existing server session) and test logging in:

ssh username@YOUR_SERVER_IP

If you set a key passphrase, enter it now. You should log in directly without being asked for your Ubuntu account password!

Step 4: (Optional & Recommended) Disable Password Authentication

Once you have verified that SSH key login works, you can disable password-based logins to completely protect your server from brute-force attempts:

1. On your Ubuntu server, open the SSH daemon configuration file:

   sudo nano /etc/ssh/sshd_config

2. Locate the PasswordAuthentication line (or add it if missing) and set it to no:

   PasswordAuthentication no

3. Also verify that PubkeyAuthentication is enabled:

   PubkeyAuthentication yes

4. Save and exit (CTRL + O, ENTER, CTRL + X).
5. Test SSH configuration syntax and restart the SSH service:

   sudo sshd -t
   sudo systemctl restart ssh
   # On Ubuntu 20.04/22.04:
   # sudo systemctl restart sshd

Frequently Asked Questions & Troubleshooting

Q: What if I lose my private key?
A: If you lose your private key and password authentication is disabled, you will need to access your server via the VNC / Web Console in your Aveshost Client Area to upload a new public key or re-enable password login temporarily.

Q: Why does the server still ask for a password after copying the key?
A: Incorrect directory or file permissions are the most common cause. Ensure ~/.ssh is set to 700 and ~/.ssh/authorized_keys is set to 600 on the server.

Q: Can I add multiple public keys for different computers?
A: Yes! Simply append each computer’s public key on a new line inside ~/.ssh/authorized_keys.

Need Further Assistance?

If you need help configuring SSH key authentication or troubleshooting access permissions on your Ubuntu VPS, our technical support team is available 24/7. Feel free to submit a support ticket through your client area for expert guidance.