SSH key: log in without a password (ed25519, PuTTYgen)

You'll create an SSH key, upload it to your VPS and log in without a password. Finally you'll turn off password login, so guessing passwords becomes pointless. The steps cover Windows, macOS, Linux and PuTTY.

How an SSH key works#

An SSH key consists of two files that belong together:

When you log in, the VPS sends your computer a challenge that only the holder of the private key can solve. The private key never leaves your computer. An ed25519 key is modern, short and secure, and all current systems support it.

You can also lock the private key with a key password (passphrase). If someone copies your key file, they can't use it without this password.

Creating a key#

What the command does:

• ssh-keygen – a program for creating SSH keys.
• -t ed25519 – the key type. We recommend Ed25519. Use the older RSA type only for devices that can't do ed25519, and then with the length -t rsa -b 4096.
• -C "notebook-jan" – a label (comment) at the end of the public key. It tells you on the VPS which computer the key is from. The label doesn't secure anything; it's just for orientation.

Creating a key in PuTTYgen#

If you connect with PuTTY, create the key in PuTTYgen, which is installed together with PuTTY.

1. Start PuTTYgen.
2. Under Parameters, choose the type EdDSA and next to it Ed25519 (255 bits).
3. Click Generate and move the mouse over the empty area of the window until the progress bar fills up. The mouse movement serves as a source of randomness.
4. In the Key comment field, type a label, for example notebook-jan.
5. In the Key passphrase and Confirm passphrase fields, enter a key password.
6. Click Save private key and save the file, for example C:\Users\<USER>\.ssh\vps.ppk. This is the private key.
7. Select and copy all the text in the Public key for pasting into OpenSSH authorized_keys file field. It starts with ssh-ed25519 AAAA… and ends with the label. This is the public key, which you upload to the VPS by hand (see the Manually tab below).

The Save public key button saves the public key in a different format that the VPS won't accept. Always copy the text from the field.

Uploading the public key to the VPS#

Logging in with the key#

The SSH client finds a key in the default location (id_ed25519) by itself, so the usual command is enough:

ssh [email protected]

If you set a password for the key, the client asks Enter passphrase for key. You enter the key password, not the root password.

You specify a key stored elsewhere or under a different name with the -i option:

ssh -i ~/.ssh/vps_klic [email protected]

• -i ~/.ssh/vps_klic – the path to the private key (the file without .pub).

PuTTY:

1. Start PuTTY and load the saved session (Load), or fill in the IP address.
2. In the tree on the left, open Connection › SSH › Auth › Credentials.
3. Next to the Private key file for authentication field, click Browse and choose the .ppk file.
4. Optional: under Connection › Data, fill in Auto-login username with root.
5. Go back to Session, click the session name and Save, so you don't have to set this up next time.
6. Click Open.

You can use a key from ssh-keygen in PuTTY too: in PuTTYgen click Load, choose the id_ed25519 file (switch the file filter to All Files) and save it with Save private key as .ppk. The other way round, you convert a PuTTYgen key to the OpenSSH format with Conversions › Export OpenSSH key.

ssh-agent: enter the key password only once#

ssh-agent remembers the unlocked key, so you don't enter the key password on every connection.

To check: ssh-add -l lists the fingerprints of the keys the agent has loaded.

The ~/.ssh/config file: connect with one word#

Save your VPS settings in the config file in the .ssh folder (Windows: C:\Users\<USER>\.ssh\config, no extension):

Host mojevps
    HostName 203.0.113.10
    User root
    Port 22
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Then you connect with ssh mojevps. scp and sftp use the shortcut too.

Turning off password login#

As long as password login is on, bots can keep trying it. Once it's off, the VPS accepts only a key.

1. Create (or open) your own SSH server configuration file:

   nano /etc/ssh/sshd_config.d/00-zabezpeceni.conf

2. Paste the settings:

   PasswordAuthentication no
   KbdInteractiveAuthentication no
   PubkeyAuthentication yes
   PermitRootLogin prohibit-password

   If the file already has PermitRootLogin no (from the Securing a new VPS guide), leave out the last line.

   Setting	What it does	Recommended value	When to change
   PasswordAuthentication	Allows password login.	no	Never, if you want passwords off.
   KbdInteractiveAuthentication	Another way of entering a password (an interactive prompt). Even with PasswordAuthentication off, a password could be entered through it.	no	yes only for two-factor authentication through PAM (advanced).
   PubkeyAuthentication	Allows key login. The default value is yes; we list it to be safe.	yes	Never.
   PermitRootLogin	Root login. prohibit-password = root only with a key.	prohibit-password	no, if you work under your own user with sudo.

3. Save and close the editor.

4. Check that exactly your values apply:

   sshd -t && sshd -T | grep -Ei "^(passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|permitrootlogin)"

   • sshd -t – checks the configuration syntax. On an error it prints the file and line, and the next command doesn't run.
   • sshd -T – prints the resulting effective configuration after loading all files.
   • grep -Ei "…" – picks out only the four settings you're checking.

   The output must contain these four lines (the order may differ):

   permitrootlogin without-password
   pubkeyauthentication yes
   passwordauthentication no
   kbdinteractiveauthentication no

   without-password is the older name for prohibit-password and means the same. Ubuntu 24.04 and Debian 13 print the older name; newer OpenSSH versions print prohibit-password. If you set no, you'll see permitrootlogin no.

   If any line shows a different value (typically passwordauthentication yes), the same setting is in a file that loads earlier. Find it with grep -rni "passwordauthentication" /etc/ssh/sshd_config.d/. Comment out the line there with a # at the beginning and repeat the check.

5. Restart the SSH server:

   systemctl restart ssh

   The current connection stays open.

6. In a new window, try to force a password login:

   ssh -o PubkeyAuthentication=no [email protected]

   The server must reply Permission denied (publickey). That's correct: it no longer accepts passwords.

7. In another window, log in normally with the key (ssh [email protected]). Only when that works, close the original window.

Multiple computers, removing and backing up a key#

• Another computer: create its own key with a different label and upload it the same way. Each key is on a separate line in ~/.ssh/authorized_keys. We don't recommend copying one private key between computers.
• Removing a key (a lost laptop, a colleague leaving): open nano ~/.ssh/authorized_keys and delete the line with its label. It takes effect immediately.
• Backup: store the private key in a password manager or on encrypted storage. If you lose it and have passwords turned off, log in through the browser console and upload a new public key.
• A user other than root: the key goes in /home/<USER>/.ssh/authorized_keys and that user must own the file.

Verification#

• ssh root@<VPS_IP_ADDRESS> logs you in without the root password (at most it asks for the key password).
• ssh -o PubkeyAuthentication=no root@<VPS_IP_ADDRESS> ends with Permission denied (publickey).
• sshd -T shows passwordauthentication no.

Troubleshooting#

The VPS still asks for the root password#

The key wasn't used. Connect with verbose output:

ssh -v [email protected]

• -v – verbose output. Look for the lines Offering public key (the client offered the key) and Server accepts key (the server accepted it).

If the client doesn't offer the key, it's in a different file: use -i or IdentityFile. If the server doesn't accept it, check the permissions on the VPS:

chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
journalctl -u ssh -n 30

• journalctl -u ssh -n 30 – the last 30 SSH server entries. The message Authentication refused: bad ownership or modes means wrong permissions or a wrong owner of the .ssh folder.

Also check that the key in authorized_keys is on one line and starts with ssh-ed25519.

Permission denied (publickey).#

Passwords are off and the server didn't accept the key. Proceed as in the previous point. If you can't log in at all, use the browser console.

Windows: WARNING: UNPROTECTED PRIVATE KEY FILE! or Bad permissions#

Other users of the computer also have access to the private key (typically after copying it from somewhere else) and the client refuses to use it. Set the permissions in PowerShell:

icacls $env:USERPROFILE\.ssh\id_ed25519 /inheritance:r
icacls $env:USERPROFILE\.ssh\id_ed25519 /grant:r "$($env:USERNAME):(R)"

• /inheritance:r – removes the permissions inherited from the folder.
• /grant:r "<USER>:(R)" – gives only your account permission to read.

On macOS and Linux you fix the same error with chmod 600 ~/.ssh/id_ed25519.

Load key "…": invalid format#

You're trying to use a key in PuTTY format (.ppk) with OpenSSH. Convert it in PuTTYgen with Conversions › Export OpenSSH key.

PuTTY: Server refused our key#

The right public key isn't on the VPS. Copy the text from the Public key for pasting into OpenSSH authorized_keys file field again (not the file from Save public key) and paste it into ~/.ssh/authorized_keys on one line.

Too many authentication failures#

The agent offers too many keys. Use IdentitiesOnly yes in ~/.ssh/config, or the options -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes.

Further reading#

• sshd_config manual page (opens in a new window)
• Ubuntu: OpenSSH server and keys (opens in a new window)
• Microsoft Learn: SSH keys on Windows (opens in a new window)
• PuTTYgen documentation (opens in a new window)