How to Configure SSH Keys

Passwords are the single weakest link in server security. Automated brute-force bots continuously hammer Linux servers trying millions of password combinations every minute. SSH keys solve this problem by replacing passwords with asymmetric cryptography.

In this guide, you will learn how to generate modern SSH keypairs and configure them on your RivinCloud VPS for instant, highly secure authentication.

1. How SSH Key Authentication Works

SSH key authentication relies on an asymmetric keypair:

1. Private Key (e.g., id_ed25519): Stored strictly on your local laptop or workstation. Never share this file with anyone.
2. Public Key (e.g., id_ed25519.pub): Placed on your remote server inside the ~/.ssh/authorized_keys file.

When you connect, the server challenges your client with an encrypted message that only your private key can decrypt.

2. Generating an SSH Keypair Locally

Run this command on your local machine (macOS, Linux, or Windows PowerShell/Git Bash):

Recommended: Modern Ed25519 Key (Faster & More Secure)

ssh-keygen -t ed25519 -C "admin@rivincloud.in"

Alternative: 4096-bit RSA Key (Legacy Compatibility)

ssh-keygen -t rsa -b 4096 -C "admin@rivincloud.in"

1. Press Enter to accept the default file location (~/.ssh/id_ed25519).
2. (Optional but recommended) Enter a passphrase to encrypt your private key on your local machine.

3. Copying the Public Key to Your Remote VPS

Method A: Using ssh-copy-id (Easiest)

From your local terminal:

ssh-copy-id -i ~/.ssh/id_ed25519.pub ubuntu@your-server-ip

Enter your user password once. The tool will automatically create the ~/.ssh/ folder on the remote server and append your key with correct permissions.

Method B: Manual Installation (Windows / Manual Copy)

If ssh-copy-id is not available:

1. Display your local public key:

   cat ~/.ssh/id_ed25519.pub
   

2. Copy the entire string output starting with ssh-ed25519 AAAA....
3. Log into your remote VPS via SSH:

   ssh ubuntu@your-server-ip
   

4. Append the key on the server:

   mkdir -p ~/.ssh
   chmod 700 ~/.ssh
   echo "PASTE_YOUR_PUBLIC_KEY_STRING_HERE" >> ~/.ssh/authorized_keys
   chmod 600 ~/.ssh/authorized_keys
   

4. Testing Your SSH Key Connection

From your local machine, connect without entering a server password:

ssh ubuntu@your-server-ip

If you set a passphrase during key creation, enter your local passphrase to unlock the key.

5. Simplifying Connections with ~/.ssh/config

To avoid typing user names, IP addresses, and ports every time, configure an SSH client alias:

Edit ~/.ssh/config on your local computer:

Host rivin
    HostName 192.0.2.10
    User ubuntu
    Port 22
    IdentityFile ~/.ssh/id_ed25519

Now you can log in simply by typing:

ssh rivin

Common Mistakes

• Copying the private key instead of the public key: NEVER upload id_ed25519 to the remote server. Only copy the .pub file!
• Incorrect permissions on .ssh folder: SSH will refuse to use authorized_keys if permissions are too open. Ensure chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys.

Troubleshooting

• Server still asks for password: Check SSH server permissions:

  sudo chmod 755 /home/ubuntu
  sudo chmod 700 /home/ubuntu/.ssh
  sudo chmod 600 /home/ubuntu/.ssh/authorized_keys
  

• Debug connection: Add verbose flags to see key negotiation: ssh -vvv ubuntu@your-server-ip.

Best Practices

• Use Ed25519 keys whenever possible; they are shorter, faster, and computationally superior to older 2048-bit RSA keys.
• Store your private keys in an SSH agent (ssh-add ~/.ssh/id_ed25519) so you don't have to re-enter your key passphrase repeatedly.

Frequently Asked Questions

Can I have multiple public keys on the same server?

Yes. Simply append each public key on a new line inside ~/.ssh/authorized_keys.

Conclusion

SSH key authentication is the cornerstone of server security. Configure your SSH keys today to secure and speed up your access to your RivinCloud VPS!