How to log in with SSH keys and turn off passwords

An SSH key replaces your password with a pair of files: a private key that stays on your computer and a public key you put on the server. Nobody can log in without the private key, so password guessing stops working completely. This guide sets up a key and then turns off password logins. It works on Debian, Ubuntu, AlmaLinux, Rocky, CentOS and Fedora.

Before you start: keep one SSH session open until the end. If something goes wrong you can fix it from there, or from Open console on your VPS page, which works without SSH.

1. Create a key on your computer

Linux, macOS and Windows 10 or 11 (PowerShell or Terminal):

ssh-keygen -t ed25519 -C "my-laptop"

Press Enter to accept the default location. When asked, set a passphrase: if someone copies the key file, they still cannot use it without the passphrase.

This creates two files in the .ssh folder of your user:

• id_ed25519: the private key. Never share it or upload it anywhere.
• id_ed25519.pub: the public key. This is the one that goes on the server.

PuTTY users: open PuTTYgen, choose EdDSA (Ed25519), click Generate, set a passphrase and save the private key as a .ppk file. Copy the text in the box at the top ("Public key for pasting into OpenSSH authorized_keys file"): that is your public key.

2. Put the public key on the server

Linux and macOS have a command that does it for you:

ssh-copy-id root@YOUR-SERVER-IP

If you use a custom SSH port, add -p 2222 after ssh-copy-id.

Windows (PowerShell):

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR-SERVER-IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

By hand (any system, or a key from PuTTYgen): log in to the server and run:

mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste the public key on its own line (it starts with ssh-ed25519), save with Ctrl+O and exit with Ctrl+X. Then:

chmod 600 ~/.ssh/authorized_keys

3. Test the key

Open a new terminal and connect:

ssh root@YOUR-SERVER-IP

It should ask for the key's passphrase (or nothing at all), not the server password. In PuTTY, load the .ppk file under Connection, SSH, Auth, Credentials before connecting.

Do not continue until this works. The next step turns off passwords.

4. Turn off password logins

sudo nano /etc/ssh/sshd_config

Set these lines (remove the # in front if there is one):

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password

On CentOS 7 the second line is called ChallengeResponseAuthentication no.

Some images turn passwords back on in a separate file. Check:

sudo grep -ri 'PasswordAuthentication' /etc/ssh/sshd_config.d/

If a file there says PasswordAuthentication yes, change it to no.

5. Check and restart SSH

sudo sshd -t

No output means the configuration is valid. Restart SSH:

• Debian and Ubuntu: sudo systemctl restart ssh
• AlmaLinux, Rocky, CentOS, Fedora: sudo systemctl restart sshd

Confirm the setting is active:

sudo sshd -T | grep -i passwordauthentication

It must print passwordauthentication no. From another computer (or with ssh -o PubkeyAuthentication=no root@YOUR-SERVER-IP), a login attempt should now fail with Permission denied (publickey). That is what you want.

Good to know

• Back up your private key (for example in your password manager). If you lose it and passwords are off, you can only get back in through the Console.
• Several computers? Create a key on each one and add every public key to ~/.ssh/authorized_keys, one per line. To revoke a device, delete its line.
• Locked out? Click Open console on your VPS page, log in with the root password (the console does not use SSH), set PasswordAuthentication yes again, restart SSH and fix your key.
• Forgot the root password too? Reset it from the panel; the console then accepts the new one.
• Next step: move SSH off port 22 as well. See our guide How to change the SSH port in Linux.