How to Set Up SSH Key Authentication on an Ubuntu VPS Print

How to Set Up SSH Key Authentication on an Ubuntu VPS

SSH key authentication is one of the most effective ways to secure remote access to a Linux server. Instead of relying on a password, SSH uses a cryptographic key pair to authenticate connections between your computer and your VPS.

In this guide, you will learn how to configure SSH key authentication on an Ubuntu VPS, generate secure Ed25519 keys, install your public key, disable password authentication, and troubleshoot common SSH connection problems.

These instructions apply to Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and other supported Ubuntu releases.

Prerequisites

• An Ubuntu VPS with SSH access.
• A user account with sudo privileges.
• A Windows, macOS, or Linux computer with an SSH client.
• Your VPS public IP address or hostname.

Need a Linux server? Explore Owned Networks KVM VPS hosting for full root access and flexible server resources.

1. Generate an SSH Key Pair

SSH authentication uses two keys:

• Private key: Remains securely stored on your computer and must never be shared.
• Public key: Can be installed on servers where you want to authenticate.

On macOS, Linux, or Windows PowerShell with OpenSSH installed, generate an Ed25519 key pair:

ssh-keygen -t ed25519 -a 100 -C "ubuntu-vps"

When prompted, choose where to save the key and configure a strong passphrase.

By default, the generated files are:

~/.ssh/id_ed25519
~/.ssh/id_ed25519.pub

Ed25519 is recommended for most modern SSH environments because it provides strong security with compact keys.

Important: If you already have an SSH key, do not overwrite it. Choose a different filename when prompted.

2. Copy Your Public Key to the Ubuntu VPS

On macOS or Linux, the easiest method is to use ssh-copy-id:

ssh-copy-id -i ~/.ssh/id_ed25519.pub ubuntu@YOUR_SERVER_IP

Replace ubuntu with your actual SSH username and YOUR_SERVER_IP with your VPS IP address.

If your SSH server uses a custom port, specify it:

ssh-copy-id -i ~/.ssh/id_ed25519.pub \
-p 2222 ubuntu@YOUR_SERVER_IP

Replace 2222 with your configured SSH port.

If ssh-copy-id is unavailable, you can install the public key manually.

3. Install an SSH Public Key Manually

Display your public key on your local computer:

cat ~/.ssh/id_ed25519.pub

Copy the entire public key, including the ssh-ed25519 prefix.

Connect to your Ubuntu VPS using your existing authentication method:

ssh ubuntu@YOUR_SERVER_IP

Create the SSH directory and set secure permissions:

mkdir -p ~/.ssh
chmod 700 ~/.ssh

Open the authorized keys file:

nano ~/.ssh/authorized_keys

Paste your public key on a single line, save the file, and set its permissions:

chmod 600 ~/.ssh/authorized_keys

Ensure the SSH directory and authorized keys file belong to the account you are configuring:

sudo chown -R "$(id -un):$(id -gn)" ~/.ssh

Never copy your private key to the VPS.

4. Test SSH Key Authentication

Before modifying SSH security settings, open a second terminal window on your local computer.

Connect using your private key:

ssh -i ~/.ssh/id_ed25519 ubuntu@YOUR_SERVER_IP

For a custom SSH port:

ssh -i ~/.ssh/id_ed25519 \
-p 2222 ubuntu@YOUR_SERVER_IP

If authentication succeeds, you should be able to access the server without entering your Linux account password. You may still be prompted for your SSH private key passphrase.

Do not disable password authentication until you have successfully tested SSH key access in a separate session.

5. Configure SSH Key Authentication on Ubuntu

Ubuntu uses the OpenSSH server configuration file:

/etc/ssh/sshd_config

Additional settings may also be loaded from:

/etc/ssh/sshd_config.d/

Before making changes, back up your existing configuration:

sudo cp /etc/ssh/sshd_config \
/etc/ssh/sshd_config.backup

Review the current effective SSH settings:

sudo sshd -T | grep -E \
'^(pubkeyauthentication|passwordauthentication|kbdinteractiveauthentication|permitrootlogin) '

Ubuntu and cloud VPS images may already contain SSH configuration snippets. Review existing settings before adding new directives.

6. Disable SSH Password Authentication

Once SSH key authentication has been verified, you can disable password-based SSH logins.

Create an SSH hardening configuration file:

sudo nano /etc/ssh/sshd_config.d/00-key-authentication.conf

Add:

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password

These settings enable public key authentication, disable password and keyboard-interactive authentication, and prevent password-based root SSH logins.

Note: PermitRootLogin prohibit-password still allows root login using SSH keys. For environments where direct root SSH access is unnecessary, consider PermitRootLogin no after confirming that a separate sudo-enabled account works correctly.

OpenSSH generally uses the first value obtained for a configuration directive. Existing configuration files, include order, and conditional Match blocks can affect the final settings.

Validate the SSH configuration:

sudo sshd -t

Verify the effective settings:

sudo sshd -T | grep -E \
'^(pubkeyauthentication|passwordauthentication|kbdinteractiveauthentication|permitrootlogin) '

Confirm that the effective values match your intended configuration before proceeding.

7. Reload the SSH Service Safely

On Ubuntu, the OpenSSH service is normally named ssh.

Reload its configuration:

sudo systemctl reload ssh

Keep your existing SSH session open.

From a separate terminal, verify that key-based authentication still works:

ssh -o PreferredAuthentications=publickey \
-o PasswordAuthentication=no \
-i ~/.ssh/id_ed25519 \
ubuntu@YOUR_SERVER_IP

Do not close your original SSH session until the new connection succeeds.

8. Simplify Connections Using SSH Config

You can configure an SSH client profile to avoid typing the full connection command every time.

On your local computer, edit:

nano ~/.ssh/config

Add:

Host my-vps
    HostName YOUR_SERVER_IP
    User ubuntu
    Port 22
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Replace the hostname, username, and port with your server details.

On macOS or Linux, secure the SSH configuration file:

chmod 600 ~/.ssh/config

You can now connect using:

ssh my-vps

9. Troubleshooting SSH Key Authentication

Permission denied (publickey): The SSH server did not accept the supplied key. Verify the username, public key installation, and authorized keys permissions.

On the VPS, check:

ls -ld ~/.ssh
ls -l ~/.ssh/authorized_keys

Expected permissions are typically:

~/.ssh                 700
~/.ssh/authorized_keys 600

Incorrect private key: Explicitly specify the private key:

ssh -i ~/.ssh/id_ed25519 \
ubuntu@YOUR_SERVER_IP

Connection refused: Verify that SSH is running and listening on the expected port:

sudo systemctl status ssh --no-pager
sudo ss -tlnp | grep sshd

Connection timed out: Check firewall rules, the VPS IP address, and any provider-level network restrictions.

Authentication debugging: Run the SSH client in verbose mode:

ssh -vvv -i ~/.ssh/id_ed25519 \
ubuntu@YOUR_SERVER_IP

Review server-side authentication logs:

sudo journalctl -u ssh -n 100 --no-pager

10. Additional SSH Security Recommendations

• Use Ed25519 SSH keys for modern OpenSSH environments.
• Protect private keys with strong passphrases.
• Never share or upload your private SSH key.
• Disable password authentication after verifying key-based access.
• Use a dedicated sudo-enabled account for administration.
• Restrict SSH access using firewall rules where practical.
• Keep OpenSSH and Ubuntu security packages updated.
• Maintain a secure recovery method through your VPS provider's console.

Changing the default SSH port may reduce automated connection attempts, but it is not a substitute for proper authentication and firewall security.

Related Ubuntu VPS Tutorials

• How to Set Up and Secure a New Ubuntu VPS
• How to Install and Configure Nginx on an Ubuntu VPS
• How to Install and Configure Apache on an Ubuntu VPS
• How to Install Docker and Docker Compose on Ubuntu

Secure Your VPS with Owned Networks

Deploy your applications on an Owned Networks KVM VPS with full root access, flexible server resources, and complete control over your Linux environment.

Whether you are hosting websites, databases, Docker containers, or development environments, securing SSH access is an essential first step in protecting your infrastructure.

Explore Owned Networks VPS Hosting and deploy your next Linux server today.