If your server accepts password logins over SSH, it is being guessed at right now. Switching to SSH keys removes that whole class of attack.
How keys work
An SSH key comes in two parts. The private key stays on your computer and never leaves it. The public key is copied to the server. When you connect, the server checks that you hold the matching private key, without the private key ever being sent.
Create a key
On macOS, Linux or Windows (PowerShell), run:
ssh-keygen -t ed25519
Accept the default location and set a passphrase. The passphrase protects the key if your laptop is stolen.
Copy the public key to the server
On macOS and Linux, ssh-copy-id user@your-server does it for you. Otherwise, add the contents of the .pub file to ~/.ssh/authorized_keys for your user on the server.
Test, then turn off passwords
Open a new terminal and log in with the key. Only when that works, edit the SSH server configuration to set PasswordAuthentication no and PermitRootLogin no (or prohibit-password), then reload SSH. Keep your existing session open until you have confirmed a fresh login works.
Good habits
- One key per person and per device, so you can remove access for one laptop without affecting others.
- Remove keys of people who leave the team.
- Never share private keys by email or chat.
- Back up your private key securely, or make sure there is another way into the server, such as a provider console.
At IDX
IDX VPS and dedicated servers come with full root access, and you can manage your own keys. Our first thirty minutes on a new VPS guide puts this step in context.
IDX on digital infrastructure
Back to blog →