SSH key login that will not lock you out

Password SSH on the open internet gets guessed. Keys are better. The failure mode is disabling passwords before the key works, which locks you out of a remote VPS. Use two sessions.

Create a key on your PC

ssh-keygen -t ed25519 -C "your@email"

Press Enter for the default path. Set a passphrase on the key. That passphrase protects the key file if your laptop is stolen; it is not the server password.

Install the public key

From your PC:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

If you cannot use ssh-copy-id, append the .pub line to ~/.ssh/authorized_keys on the server, then:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Permissions that are too open make OpenSSH ignore the file.

Test before you change sshd

Keep your current SSH window open. Open a second terminal and run:

ssh user@server

You should get in with the key (and key passphrase), not the account password. Only then edit sshd.

Harden sshd

On the server, in /etc/ssh/sshd_config or a file under /etc/ssh/sshd_config.d/:

PasswordAuthentication no
PermitRootLogin no
KbdInteractiveAuthentication no

Then:

sudo sshd -t && sudo systemctl reload ssh

If sshd -t reports an error, do not reload. If the new session still works, you can close the old one.

Provider “console” access (Hetzner, Hostinger, AWS serial) is your safety net. Confirm you have it before disabling passwords on a cloud VM.