Configure SSH key authentication

SSH keys are more secure than passwords and allow you to connect without entering credentials each time.

Step 1 — Generate the key pair

On your local machine:

ssh-keygen -t ed25519 -C "your-email@example.com"

If your system doesn't support Ed25519:

ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

Two files are generated:

• ~/.ssh/id_ed25519 — private key (never share this)
• ~/.ssh/id_ed25519.pub — public key (copy this to the server)

Step 2 — Copy the key to the server

ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@YOUR_IP

If ssh-copy-id is not available:

cat ~/.ssh/id_ed25519.pub | ssh deploy@YOUR_IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Step 3 — Verify passwordless access

ssh deploy@YOUR_IP

You should log in without being prompted for a password.

Step 4 — Disable password authentication

On the server:

sudo nano /etc/ssh/sshd_config

Modify:

PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no

Restart SSH:

sudo systemctl restart sshd

Step 5 — Configure SSH Agent

To avoid typing the passphrase every time:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Step 6 — SSH config file

Create ~/.ssh/config to simplify connections:

Host my-vps
    HostName YOUR_IP
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    Port 22

Now connect with:

ssh my-vps

Step 7 — Correct permissions

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys

Multiple keys

You can have different keys for different servers. Specify which to use in ~/.ssh/config or with -i:

ssh -i ~/.ssh/production_key deploy@PRODUCTION_IP

With SSH keys configured, your Baires Host VPS is protected against password brute-force attacks.