Set up SSH key authentication

Prepare a working connection

Start with a working login and a sudo account on Ubuntu 24.04 LTS or AlmaLinux 9. Keep that connection open throughout the procedure. The commands labelled computer are for a Linux, macOS, or WSL terminal; server commands run on the VPS.

Replace YOUR_SERVER, YOUR_PORT, and deploy with your own address, actual SSH port, and username. Port 22 is the default, not a guarantee. Use the same SSH port as your current working connection.

Generate a key on your computer

Use a passphrase to protect the private key. If the suggested filename already exists, choose another filename rather than overwriting an existing key. The file ending in .pub is public; the file without that extension must remain on your computer.

Ed25519 works on standard installations. For an AlmaLinux system operating in FIPS mode, follow its approved algorithm policy; RSA with a suitable key length is an alternative because Ed25519 is not available in that mode.

ssh-keygen -t ed25519 -C "vps-admin"

Install only the public key

ssh-copy-id appends the public key to the target account's authorized_keys file. This requires an existing authentication method. If password login is unavailable, use your existing administrator connection or recovery console to install the public key in that user's home directory.

Check permissions while signed in as the target user. The directory should be accessible only to its owner and the key list must not be writable by anyone else. On AlmaLinux, restore the standard SELinux labels rather than disabling SELinux.

ssh-copy-id -i ~/.ssh/id_ed25519.pub -p YOUR_PORT deploy@YOUR_SERVER

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

sudo restorecon -RFv ~/.ssh

Prove the key works independently

Open a fresh terminal. This test disables password and keyboard-interactive fallback for this connection, so a successful login proves the selected key works. A prompt for the key's passphrase is expected. Test sudo after connecting and leave the original session open.

ssh -p YOUR_PORT -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no deploy@YOUR_SERVER

sudo -v

Optional: turn off password login

Only after a successful key test, use sudoedit to review the active authentication settings in /etc/ssh/sshd_config and its included snippets. PasswordAuthentication no and KbdInteractiveAuthentication no disable those alternatives. Included snippets and Match blocks affect which settings apply; check the effective configuration as well as syntax.

Reload only when sshd -t succeeds without errors, using the service name for your distribution. Repeat the fresh key login before closing your original session. Keep a tested recovery method.

sudo /usr/sbin/sshd -t
sudo /usr/sbin/sshd -T

sudo systemctl reload ssh.service

sudo systemctl reload sshd.service