Connecting with an SSH Key

Using an SSH key to access your server improves security (by reducing the risk of your account being compromised) and convenience (you don't have to enter a password every time you connect).

Setting up key-based authentication involves creating keys on your local computer and then copying them to the server.

You can also add a key to a cloud server through the control panel when creating a new VPS or reinstalling the system. In addition, you can store keys in the control panel for later use when creating servers.

Linux, MacOS, Windows 10

Creating SSH keys

This process works on Linux, MacOS, and Windows 10 version 1809 and later, since they include a built-in SSH client. For earlier versions of Windows, use the instructions for older Windows versions (without OpenSSH).

Open a terminal or Windows PowerShell on your computer and run the command:

ssh-keygen

You will see the following message:

Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):

Just press Enter, and the key will be saved to the default directory shown.

Next, you will be prompted to set a password (passphrase) for the key. You can set one or leave it empty by pressing Enter. Note that if you use a passphrase, you will need to enter it every time you authenticate with the key.

The keys have now been created and saved in the ~/.ssh/ directory as id_rsa and id_rsa.pub. Now you need to copy the public key to the server.

Copying the key to the server

In the terminal, run the following command, replacing user with the user name on the server and server with your server's IP address:

ssh-copy-id user@server>

# Example: ssh-copy-id [email protected]

The contents of the id_rsa.pub public key file will be copied to the ~/.ssh/authorized_keys file on the server. From then on, you can connect to the server with the command:

ssh user@server>

# Example: ssh [email protected]

Older versions of Windows (without OpenSSH)

If you have an older version of Windows without OpenSSH, you will need PuTTYgen. You can download it from the official PuTTY website.

Creating SSH keys with PuTTYgen

1. Launch the program, select the RSA key type under "Type of key to generate", and click "Generate".
2. Move the mouse randomly over the window to generate random data.
3. Once the key is generated, you can set a "Key passphrase" (a password for the key). This is optional, and you can leave the field empty. If you set a passphrase, you will be asked for it every time you authenticate with the key.
4. Save the keys by clicking "Save public key" and "Save private key", using names such as id_rsa.pub and mykey.ppk.
5. Also copy the contents of the "Public key for pasting…" box and save it in a text file. You will need it when copying the key to the server.

This completes the key creation process.

Copying the key to the server with Pageant

To copy the keys, you will need Pageant. You can download it from the official PuTTY website.

1. Connect to the server via SSH and run the following commands to create a directory and a file on the server for storing keys:

mkdir ~/.ssh
chmod 0700 ~/.ssh
touch ~/.ssh/authorized_keys
chmod 0644 ~/.ssh/authorized_keys

2. Open the ~/.ssh/authorized_keys file in a text editor:

nano ~/.ssh/authorized_keys

3. Paste the contents of the public key you copied from PuTTYgen earlier into the file and save it.
4. Launch Pageant, and its icon will appear in the system tray. Right-click it and select "Add Key".
5. In the window that opens, select the mykey.ppk private key you saved earlier and click "Open". If you set a passphrase when creating the key, Pageant will ask for it at this point.
6. To test key-based authentication, launch PuTTY again, connect to the server, and enter your login. If everything is set up correctly, you will see a message like this in the console window:

Authenticating with public key "rsa-key-20151220" from agent

Disabling password access

To allow access to the server only with a key, you need to disable password authentication. To do this, edit the /etc/ssh/sshd_config file.

1. Open the file with the following command:

sudo nano /etc/ssh/sshd_config

2. Find the PasswordAuthentication line and change it to: PasswordAuthentication no.
3. Save the changes and restart the SSH service:

sudo service ssh restart

If you are still asked for a password after these steps, check whether there is a 50-cloud-init.conf file with the PasswordAuthentication yes directive in the /etc/ssh/sshd_config.d/ directory. If the file exists, delete it and restart the SSH service.