How to Create and Connect SSH Keys to Any Linux VPS (Windows & Mac)

Logging into your Linux cloud VPS using a traditional text password is one of the single biggest security risks in modern web hosting. Automated bot networks continuously scan the global IPv4 address space, launching millions of dictionary attacks against default usernames.

By generating an Ed25519 SSH Key Pair and disabling password authentication, you replace vulnerable text passwords with 256-bit elliptic curve mathematical cryptography that cannot be brute-forced.

In this technical masterclass, you will learn how to generate Ed25519 keys on Windows and Mac, copy your public key to any Linux server, configure ~/.ssh/config for instant login, and fix common permission errors in 2026.

---

Direct Answer: How Do You Connect SSH Keys to a Linux VPS?

Direct Answer: 1. Generate an Ed25519 key on your local machine by running ssh-keygen -t ed25519 -C "your-email", 2. Copy the public key to your cloud server using ssh-copy-id deployer@YOUR_SERVER_IP, 3. Test logging in passwordlessly with ssh -i ~/.ssh/id_ed25519 deployer@YOUR_SERVER_IP, and 4. Disable password login by setting PasswordAuthentication no in /etc/ssh/sshd_config.

---

SSH Key Algorithms Comparison: Ed25519 vs RSA vs ECDSA

Algorithm	Key Length	Security Grade	2026 Recommendation
Ed25519 (Elliptic Curve)	256 bits	Military-Grade / Modern Standard	🏆 Gold Standard (Recommended)
RSA 4096	4096 bits	High Security (Legacy standard)	✅ Acceptable Fallback
RSA 2048	2048 bits	Moderate / Deprecated	⚠️ Deprecated (Phasing out)
ECDSA	256 / 384 bits	High (NIST Curves)	⚠️ Acceptable

---

Step-by-Step Key Generation & Configuration Blueprint

Step 1: Generate Ed25519 Key Pair

Open Windows Terminal, PowerShell, or macOS Terminal:

ssh-keygen -t ed25519 -C "vps-admin"

Press Enter to save to default location (~/.ssh/id_ed25519) and enter a secure passphrase.

Step 2: Copy Key to Remote Linux VPS

ssh-copy-id deployer@YOUR_SERVER_IP

Step 3: Configure 1-Click SSH Config Shortcut

Create or edit ~/.ssh/config on your local computer:

Host cloudvps
    HostName 123.45.67.89
    User deployer
    IdentityFile ~/.ssh/id_ed25519
    Port 22

You can now connect to your server simply by typing: ssh cloudvps.

Step 4: Disable Insecure Password Authentication

On your Linux VPS, edit /etc/ssh/sshd_config and set:

PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no

Restart SSH: sudo systemctl restart ssh.

---

Frequently Asked Questions (FAQ)

Advanced SSH Security: 2FA with Google Authenticator & YubiKey

For mission-critical production servers, pairing Ed25519 SSH keys with Multi-Factor Authentication (MFA) adds an impenetrable security barrier. Even if an attacker compromises your private key file, they cannot access your server without the time-based one-time password (TOTP) from your authenticator app.

Install the libpam-google-authenticator package on Ubuntu 24.04:

sudo apt install libpam-google-authenticator -y
google-authenticator

Follow the terminal prompts to scan the QR code with Google Authenticator, Authy, or 1Password. Update /etc/pam.d/sshd to require PAM authentication, ensuring military-grade security for your cloud infrastructure.

Managing SSH Keys Across Multi-Server Fleets

If you manage multiple VPS instances for clients or development staging, use an SSH Agent to manage passphrases without typing them on every connection:

# Start ssh-agent in background
eval "$(ssh-agent -s)"

# Add private key to agent memory
ssh-add ~/.ssh/id_ed25519

Step-by-Step PuTTY & Pageant Configuration for Windows Users

If you prefer using classic GUI SSH clients like PuTTY on Windows instead of the Windows Terminal OpenSSH client, follow these configuration steps to convert and load your Ed25519 keys:

1. Open PuTTYgen (PuTTY Key Generator).
2. Select Ed25519 under parameters at the bottom of the window.
3. Click Generate and move your mouse randomly inside the blank area to generate entropy.
4. Enter a strong key passphrase and save both the private key (.ppk) and public key.
5. In PuTTY, navigate to Connection > SSH > Auth > Credentials, browse to your .ppk private key file, and save your session profile.

How to Revoke and Rotate Compromised SSH Keys

If a developer leaves your team or an administrative laptop is lost or stolen, immediately revoke the compromised SSH key. Connect to your VPS and edit ~/.ssh/authorized_keys:

# Open authorized_keys file
nano ~/.ssh/authorized_keys

# Locate and delete the line containing the compromised public key
# Save with Ctrl+O and exit with Ctrl+X

Once removed, any connection attempts using the old private key will be rejected immediately by the OpenSSH daemon without requiring a server reboot.