Blog Winston AI @CustomerPanel
UnderHost
Knowledgebase Docs
/
Tools
SSH Security Beginner

Generate SSH Keys for Secure VPS Access

Create SSH key pairs for secure, password-free authentication. Ed25519 vs RSA, key management, passphrase protection, key permissions.

UnderHost NOC Network Operations
9 min read Updated June 2026
On this page

SSH keys are far more secure than passwords. They use public-key cryptography: your private key (stays on your computer) proves your identity, while the public key (on the server) verifies the signature. Password attacks can't work against SSH keys. No brute-force possible.

Why SSH Keys?

  • Security: No password to intercept or guess
  • Convenience: Auto-login with optional passphrase protection
  • Auditability: Can list authorized keys, see who has access
  • Automation: Scripts can connect without interactive password

Key Types: Ed25519 vs RSA

TypeKey SizeSpeedSecurityRecommendation
Ed25519256 bits⚡ FastModern, excellent✅ Use this
RSA 40964096 bitsSlowerGood, olderFallback if needed

Generate Keys

Windows (PowerShell), Mac (Terminal), Linux (Bash):

# Generate Ed25519 key (recommended)
ssh-keygen -t ed25519 -C "your-email@example.com"

# Or RSA 4096 (if Ed25519 not supported)
ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

Prompts:

# You'll be asked:
Enter file in which to save the key [/home/user/.ssh/id_ed25519]:
# Press Enter to accept default

Enter passphrase (empty for no passphrase):
# Set a passphrase (optional but recommended for security)
# If passphrase: SSH prompts for it once per terminal session

This creates two files:**

  • ~/.ssh/id_ed25519 - Private key (keep secret, never share)
  • ~/.ssh/id_ed25519.pub - Public key (safe to share, goes on servers)

Add to Server

Method 1: ssh-copy-id (easiest):

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@your-vps-ip

Method 2: Manual (if ssh-copy-id unavailable):**

# Connect with password
ssh root@your-vps-ip

# On the server:
mkdir -p ~/.ssh
chmod 700 ~/.ssh

# Paste your public key into authorized_keys
cat >> ~/.ssh/authorized_keys
# Paste your public key from ~/.ssh/id_ed25519.pub here
# Press Ctrl+D when done

chmod 600 ~/.ssh/authorized_keys

Connect with Keys

# Simple (if SSH finds key automatically)
ssh root@your-vps-ip

# Explicit key
ssh -i ~/.ssh/id_ed25519 root@your-vps-ip

# With custom port
ssh -i ~/.ssh/id_ed25519 -p 2222 root@your-vps-ip

File Permissions

# Correct permissions (required)
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519         # Private key
chmod 644 ~/.ssh/id_ed25519.pub     # Public key
chmod 600 ~/.ssh/authorized_keys     # Authorized keys on server

# Check permissions
ls -la ~/.ssh/

Multiple Keys

# Generate named keys for different servers
ssh-keygen -t ed25519 -f ~/.ssh/prod_key -C "production server"
ssh-keygen -t ed25519 -f ~/.ssh/staging_key -C "staging server"

# Configure ~/.ssh/config for easy use
Host prod
    HostName prod.example.com
    IdentityFile ~/.ssh/prod_key
    User root

Host staging
    HostName staging.example.com
    IdentityFile ~/.ssh/staging_key
    User root

# Now: ssh prod (automatically uses correct key)

Troubleshooting

# SSH key not being recognized?
# Check key permissions (must be 600)
ls -la ~/.ssh/id_ed25519

# Verbose SSH output shows what keys are tried
ssh -v root@your-vps-ip

# Server side: check authorized_keys
ssh root@your-vps-ip cat ~/.ssh/authorized_keys
# Your public key should be in this file

# Verify public key format (should start with ssh-ed25519)
cat ~/.ssh/id_ed25519.pub
Never share your private key

Your private key (id_ed25519) must stay on your computer. Only the public key (.pub) goes on servers. Anyone with your private key can access all your servers.

Related: SSH config file | SSH hardening | VPS SSH access | Secure shell

Was this article helpful?

Need a developer-friendly server?

Use an UnderHost Cloud VPS for SSH, Git, Node.js, Python, Laravel, Docker, cron, and custom development workflows.

View Cloud VPS CustomerPanel

Related articles

Back to Developer Tools