How to Set Up SSH Key Authentication

An SSH key is a pair of files. The private key stays on your computer and works like a password that can’t be guessed. The public key goes on the server. This guide adds a key alongside your password; it doesn’t switch password login off.

Before you start

• Warning: connect to your VPS as the user who will use the key, and keep that window open until you’ve tested the key. It’s your way back in if something goes wrong.
• If your VPS has cPanel/WHM or Plesk, the panel may manage SSH keys too. Not sure which to use? Open a support ticket first.
• Your plan includes Core Managed, so open a support ticket before you change any other SSH or firewall settings.
• Replace username, 203.0.113.10 and PORT with the login details we gave you when your server was set up. If your port is 22, leave out -p PORT.

Step 1: Create a key on your computer

1. Open a new PowerShell window (Windows) or Terminal window (Mac or Linux) on your own computer. Don’t use the window that’s connected to your server.
2. Run this. It creates the key pair on your computer only; -C adds a label to help you recognize the key.

   ssh-keygen -t ed25519 -C "you@yourdomain.com"

3. Press Enter to accept the suggested file location.
4. Type a passphrase and press Enter, then type it again. Nothing appears while you type. Keep the passphrase safe, such as in a password manager: it can’t be recovered.

You now have id_ed25519 (the private key: never share it, even with us) and id_ed25519.pub (the public key, which you copy) in the .ssh folder in your home folder.

Step 2: Add the public key to your VPS

On a Mac or Linux computer

1. In the window from Step 1, run this. It adds your public key to ~/.ssh/authorized_keys on the server and keeps keys already there.

   ssh-copy-id -i ~/.ssh/id_ed25519.pub -p PORT username@203.0.113.10

2. Type your server password when asked. You’ll see Number of key(s) added: 1.

On Windows

1. In the PowerShell window from Step 1, run this to copy your public key to the clipboard:

   Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard

2. Switch to the window that’s connected to your server.
3. Run mkdir -p ~/.ssh. This creates the .ssh folder if it’s missing.
4. Run chmod 700 ~/.ssh. This lets only you open the folder.
5. Warning: this command needs two > signs; with one, it would erase the keys already in the file. Run cat >> ~/.ssh/authorized_keys. The cursor waits on an empty line.
6. Press Enter once. Then right-click in the window to paste your key, and press Enter again. (The extra empty line is harmless; it makes sure your key starts on its own line.)
7. Press Ctrl+D. This saves the key and brings your prompt back.
8. Run chmod 600 ~/.ssh/authorized_keys. This lets only you change the file; the server ignores a file others can change.

Step 3: Test in a second window

1. Leave the window that’s connected to your server open.
2. Open a new PowerShell or Terminal window and connect as usual, for example ssh -p PORT username@203.0.113.10.
3. If you see Enter passphrase for key, type your key’s passphrase and press Enter. If you see username@203.0.113.10's password: instead, the key isn’t working: press Ctrl+C and see Troubleshooting.

How to tell it worked

You’re logged in without typing the server password. Now you can close the first window.

How to undo it

1. In your open session, run nano ~/.ssh/authorized_keys (a simple editor). If you see nano: command not found, open a support ticket.
2. Use the arrow keys to move to the line that ends with your label, for example you@yourdomain.com.
3. Press Ctrl+K once to remove that line. Don’t change any other line: other lines may be keys that other people or tools use.
4. Press Ctrl+O, then Enter to save, then Ctrl+X to exit.

Troubleshooting

• You’re still asked for the server password: the key wasn’t added for this user. Check you used the same username in Steps 2 and 3. The server also ignores the key if other users can change your files: in your open session, run chmod go-w ~, chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys.
• Pasting the key doesn’t work: press Ctrl+C in the server window and open a support ticket.
• You lost the private key or think someone copied it: remove its line from authorized_keys (see How to undo it) and create a new key.

Still need help?

Open a support ticket from the Client Portal at my.bluearctic.com. Our support page explains how the 24/7 helpdesk works. Include your VPS IP address, the username, the output of your connection attempt with -v added, and what you already tried. You may paste your public key (the one line in the .pub file); it’s safe to share. Never share your private key (the file without .pub). Never include a password.