SSH, Using Key-Based Authentication and Disabling Password Access

Logging in to your VPS with an SSH key instead of a password stops the password-guessing bots that hit every server on the internet. The switch takes about ten minutes: create a key on your computer, copy the public half to the server, prove it works, and only then turn password login off. This page gives you the safe order for your own VPS.

1. Create a key on your computer

Open Terminal on macOS or Linux, or PowerShell on Windows 10 and 11, and run:

ssh-keygen -t ed25519 -C "office-laptop"

Accept the default location and set a passphrase. You get two files: id_ed25519 (private, never share it) and id_ed25519.pub (public, goes on the server). Use Ed25519 unless an old tool cannot read it; then use -t rsa -b 4096. Older guides show a 4096-bit RSA key as the default; Ed25519 is the better choice today.

2. Copy the public key to the VPS

Log in with the credentials you were given for the VPS, and add your public key to the account you will use.

macOS and Linux:

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@your_vps_ip

Windows (PowerShell), which has no ssh-copy-id:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@your_vps_ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Both commands ask for the current password one last time and append the key to ~/.ssh/authorized_keys on the server.

3. Test the key before changing anything

ssh -i ~/.ssh/id_ed25519 root@your_vps_ip

You should be asked for your key's passphrase, not the server password. If you are still asked for the server password, the key was not accepted: check that ~/.ssh is 700 and authorized_keys is 600 on the server, and that the key is on one line. Do not continue until key login works.

4. Turn off password login

Modern Ubuntu, Debian, AlmaLinux and Rocky Linux read extra settings from /etc/ssh/sshd_config.d/. For each setting, SSH uses the first value it finds, and a file such as 50-cloud-init.conf can switch passwords back on. Create a file that sorts first:

sudo nano /etc/ssh/sshd_config.d/00-key-only.conf

Add these lines:

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password

prohibit-password still lets root log in with a key. Once you have a non-root user with sudo, change it to no.

5. Prove passwords are really off

From a new terminal, first confirm the key still works, then try to force a password login:

ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password root@your_vps_ip

The server should reply Permission denied (publickey). If it still asks for a password, another file in sshd_config.d or the main sshd_config is overriding yours; run the sshd -T check again.

6. On Domain India hosting

• VPS: a Domain India VPS is self-managed, with full root access. Everything above is yours to set up, and the SSH configuration is yours to maintain.
• Shared hosting (cPanel, DirectAdmin, Webuzo): jailed SSH access is available on every shared hosting plan. It is off by default; ask support to enable it for your account. Password login over SSH is already switched off on our cPanel and DirectAdmin servers, so you add a public key in the panel instead of editing any server file. See enabling and accessing jailed SSH.
• Windows (Plesk) hosting has no SSH.

The plan card shows the live Domain India list price, excluding 18% GST.

Ready to lock down your server? Create your key with Generating SSH keys, then work through the SSH security hardening checklist. For a new server, see Domain India VPS plans.