Tutorial 📅 January 21, 2025 📖 8 min read

SSH Keys Explained: How to Set Up Without Terminal (2025)

Learn SSH key authentication for VPS security. Generate, configure, and use SSH keys without command line knowledge. Windows, Mac, Linux guides.

Passwords are the weakest link in VPS security. A single compromised password can give attackers complete access to your server, data, and applications. That's where SSH keys come in - they're virtually impossible to brute-force and significantly more secure than traditional passwords.

In this comprehensive guide, I'll explain what SSH keys are, how they work, and most importantly - how to generate and configure them on Windows, Mac, and Linux without needing terminal expertise. By the end of this guide, your VPS will be protected by military-grade encryption.

What Are SSH Keys?

SSH (Secure Shell) keys are a pair of cryptographic keys used for authentication. Think of them as a highly sophisticated lock-and-key system:

When you try to connect to your VPS, the server uses the public key to create an encrypted challenge that only the matching private key can solve. This proves you're the legitimate owner without ever transmitting your password over the network.

The Security Advantage: SSH keys use 2048-bit or 4096-bit encryption. To put this in perspective, a password-based attack might succeed in days or weeks, but cracking an SSH key would take millions of years with current computing power.

SSH Keys vs Passwords: The Comparison

Feature Password Auth SSH Key Auth
Security Vulnerable to brute force Nearly impossible to crack
Phishing Risk High (password can be stolen) Low (key never leaves device)
Convenience Must type every time Automatic login
Complexity Easy to remember/forget One-time setup
Automation Difficult (exposes password) Perfect for scripts
Multiple Devices Same password everywhere Unique key per device

How SSH Key Authentication Works (Simple Explanation)

Here's what happens when you connect to your VPS with SSH keys:

  1. You initiate connection: Your SSH client says "I want to connect as user@server"
  2. Server sends challenge: The server encrypts a random message using your public key
  3. Your computer responds: Your private key decrypts the message and sends back the answer
  4. Server verifies: If the answer is correct, you're authenticated and logged in

This entire exchange happens in milliseconds. The private key never leaves your computer, and the encrypted challenge can't be decrypted by anyone intercepting the connection.

Step 1: Generate SSH Key Pair

You'll generate keys on your local computer (Windows, Mac, or Linux). Choose your operating system below:

Windows (Method 1: PowerShell - Recommended)

Windows 10/11 includes OpenSSH built-in:

  1. Open PowerShell (Win + X, then "Windows PowerShell")
  2. Run this command:
ssh-keygen -t ed25519 -C "your_email@example.com"

Or for older systems that don't support ed25519:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
  1. Press Enter to save in default location (C:\Users\YourName\.ssh\id_ed25519)
  2. Enter a passphrase (optional but recommended for extra security)
  3. Keys are generated! Your public key is at C:\Users\YourName\.ssh\id_ed25519.pub

Windows (Method 2: PuTTYgen)

  1. Download PuTTY installer from putty.org
  2. Run PuTTYgen (included in PuTTY installer)
  3. Select "EdDSA" and "Ed25519" (or RSA with 4096 bits)
  4. Click "Generate" and move mouse randomly for entropy
  5. Add key comment (your email) and passphrase (optional)
  6. Click "Save private key" (save as .ppk file)
  7. Copy the public key from the text box (starts with "ssh-ed25519")

Mac and Linux

Open Terminal and run:

ssh-keygen -t ed25519 -C "your_email@example.com"

Or for compatibility with older systems:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
  1. Press Enter to save in default location (~/.ssh/id_ed25519)
  2. Enter passphrase (recommended)
  3. Keys generated! Public key is at ~/.ssh/id_ed25519.pub
Ed25519 vs RSA: Ed25519 is newer, faster, and more secure with smaller key sizes (256-bit security). RSA 4096 is older but universally compatible. Use Ed25519 unless you need compatibility with ancient systems.

Step 2: View Your Public Key

Windows (PowerShell)

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

Mac/Linux (Terminal)

cat ~/.ssh/id_ed25519.pub

You'll see output like:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILl8vY7wnQ4qN2wH8dFsG8qz6N3KlO4Zb1L8vN2M3nD4 your_email@example.com

Copy this entire line - you'll need it in the next step.

Step 3: Add Public Key to Your VPS

Now you need to add your public key to the VPS. There are three methods:

Method 1: Using VPS Commander (Easiest)

  1. Log in to VPS Commander
  2. Connect to your VPS
  3. Go to "SSH Keys" section
  4. Click "Add SSH Key"
  5. Paste your public key and give it a name
  6. Click "Save"

Done! VPS Commander automatically configures everything correctly.

Method 2: Using ssh-copy-id (Mac/Linux)

If you can still log in with password:

ssh-copy-id username@your_vps_ip

Enter your password when prompted. The public key is automatically added.

Method 3: Manual Configuration (All Platforms)

Log in to your VPS with password authentication, then run:

mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste your public key (the entire line from Step 2) into this file. Save and exit (Ctrl+X, Y, Enter).

Set correct permissions:

chmod 600 ~/.ssh/authorized_keys
Public Key Added! Your VPS now recognizes your SSH key. Let's test the connection.

Step 4: Test SSH Key Connection

Windows (PowerShell)

ssh username@your_vps_ip

Mac/Linux (Terminal)

ssh username@your_vps_ip

Windows (PuTTY)

  1. Open PuTTY
  2. Enter hostname: username@your_vps_ip
  3. Go to Connection > SSH > Auth > Credentials
  4. Browse and select your .ppk private key file
  5. Go back to Session, save the session for future use
  6. Click "Open"

If configured correctly, you'll be logged in without entering a password (or only enter your key passphrase if you set one).

Simplify SSH Key Management

VPS Commander includes built-in SSH key management with a graphical interface. Generate keys, add them to multiple servers, rotate keys, and manage authentication - all without touching the terminal.

Try VPS Commander Free

Step 5: Disable Password Authentication (Critical Security Step)

Once SSH key authentication works, disable password authentication to prevent brute-force attacks:

Edit SSH Configuration

sudo nano /etc/ssh/sshd_config

Find and modify these lines:

PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
UsePAM no

For extra security, disable root login:

PermitRootLogin no

Restart SSH Service

sudo systemctl restart sshd
Important Warning: Before disabling password authentication, make absolutely certain your SSH key login works. Test from multiple terminals. If you lock yourself out, you'll need to access your VPS through your provider's web console to fix it.

Step 6: Advanced SSH Key Configuration

Using SSH Config File (Mac/Linux/Windows)

Create or edit ~/.ssh/config (Windows: C:\Users\YourName\.ssh\config):

Host myserver
    HostName your_vps_ip
    User your_username
    IdentityFile ~/.ssh/id_ed25519
    Port 22

Host production
    HostName 203.0.113.50
    User deploy
    IdentityFile ~/.ssh/production_key
    Port 2222

Now you can connect with just:

ssh myserver

SSH Agent (Avoid Entering Passphrase Repeatedly)

Mac: SSH agent runs automatically. Add your key:

ssh-add ~/.ssh/id_ed25519

Make it persist across reboots:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Linux:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Windows: Enable SSH Agent service:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

Multiple SSH Keys for Different Servers

Generate additional keys with different names:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_work -C "work@example.com"
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_personal -C "personal@example.com"

Specify which key to use in your SSH config file (shown above) or when connecting:

ssh -i ~/.ssh/id_ed25519_work username@server

Managing Multiple Servers

For managing multiple VPS servers with different SSH keys:

Option 1: Separate Key Per Server (Most Secure)

Generate a unique SSH key for each server. If one key is compromised, only that server is at risk.

Option 2: One Key for All Personal Servers

Use the same key across your personal VPS instances for convenience. Still much more secure than passwords.

Option 3: Different Keys for Different Environments

Troubleshooting SSH Key Issues

Issue: Permission Denied (Publickey)

Cause: SSH key not recognized by server or incorrect permissions.

Solutions:

Issue: SSH Key Not Being Used

Cause: SSH client using wrong key or key not loaded.

Solutions:

Issue: Too Many Authentication Failures

Cause: SSH tries all keys in ssh-agent before the correct one.

Solution: Specify the exact key:

ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 user@server

Or add to ~/.ssh/config:

Host myserver
    IdentitiesOnly yes
    IdentityFile ~/.ssh/id_ed25519

Issue: Locked Out After Disabling Password Auth

Solution: Access your VPS through your provider's web console (DigitalOcean Droplet Console, Vultr VNC Console, etc.) and re-enable password authentication temporarily:

sudo nano /etc/ssh/sshd_config
# Change PasswordAuthentication no to yes
sudo systemctl restart sshd

Fix your SSH key configuration, then disable password auth again.

Issue: Host Key Verification Failed

Cause: Server's host key changed (server reinstalled or MITM attack).

Solution (if you reinstalled the server):

ssh-keygen -R your_vps_ip

Then reconnect and accept the new host key.

SSH Key Security Best Practices

1. Use Strong Key Types

2. Protect Your Private Key

3. Rotate Keys Periodically

Generate new SSH keys every 1-2 years and update all servers. This limits exposure if a key is ever compromised.

4. Unique Key Per Device

Use different keys for laptop, desktop, and phone. If one device is compromised, others remain secure.

5. Remove Old Keys

Regularly audit ~/.ssh/authorized_keys on your servers and remove keys from old devices or ex-employees.

6. Use SSH Certificates for Teams

For organizations with multiple admins, use SSH certificate authorities instead of managing individual keys on each server.

7. Monitor SSH Logins

Check authentication logs regularly:

sudo tail -100 /var/log/auth.log | grep sshd

Look for failed login attempts or logins from unexpected IP addresses.

SSH Keys with VPS Commander

VPS Commander simplifies SSH key management with:

Conclusion: Embrace SSH Key Security

SSH keys are the gold standard for VPS authentication. They provide:

Setting up SSH keys takes 10-15 minutes but provides years of improved security and convenience. Once configured, you'll never have to type a password again - and your VPS will be protected from 99% of common attacks.

Whether you're managing one server or a hundred, SSH key authentication is essential. And with tools like VPS Commander, you don't need to be a Linux expert to implement best-practice security.

Next Steps: Now that SSH keys are configured, enhance your security further with our VPS Security Basics Guide and learn about firewalls, fail2ban, and security hardening.

Related Articles