> The full list of articles is in [llms.txt](https://docs.f3cloud.com/llms.txt). Every page has a Markdown version: add .md to its address. This page as Markdown: [https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/ssh-keys.md](https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/ssh-keys.md).

# SSH key login and disabling password login in Linux

How to set up SSH key login to a server, create a separate user with sudo and disable password and root login. Commands for Ubuntu, Debian, AlmaLinux, CentOS and Oracle Linux.

A password can be guessed, but an SSH key cannot. That is why the most useful way to protect a server is to log in with a key and turn off password login completely. Then the bots that guess passwords around the clock simply run into a locked door.

Here is what we will do, step by step.

1. create a separate user instead of root;
2. create an SSH key on your computer;
3. copy the key to the server;
4. check that key login works;
5. disable password login and root login.

> **What you will need.**
>
> To begin, you need SSH access to the server as root. The IP address and password are in the email you receive after ordering and in the “Instructions” section of the client area. We showed where to find it in the article [on ordering a VPS](https://docs.f3cloud.com/en/client-area/order-vps.md#access).

***

### 1. Create a separate user

The commands are run on the server, as root.

Working as root every day is unsafe, because a single mistake or a stolen password gives an attacker full access. So we will create a regular user and give them the right to run administrator commands through `sudo`.

#### Ubuntu and Debian

```bash
# Create the user admin (you can choose any name).
# The command asks you to set a password, and you can skip the
# other questions with the Enter key
adduser admin

# Add the user to the sudo group so they can run administrator
# commands
usermod -aG sudo admin
```
#### AlmaLinux, CentOS, Oracle Linux

```bash
# Create the user admin (you can choose any name)
adduser admin

# Set a password for the user
passwd admin

# On these systems administrators belong to the wheel group
usermod -aG wheel admin
```

You will still need the user's password, because `sudo` asks for it. But you will soon no longer need it to log in to the server.

***

### 2. Create an SSH key on your computer

This command is run on your own computer. On Windows, open PowerShell, and on macOS and Linux, open Terminal.

```bash
# Create an ed25519 key, a modern and secure option
ssh-keygen -t ed25519 -a 64
```

The program will ask a couple of questions.

* **where to save the key** – just press <kbd>Enter</kbd>;
* **passphrase** – a password for the key itself. It is best to set one, because then nobody can use a stolen key file without it.

As a result, two files will appear in your user's `.ssh` folder.

* `id_ed25519` – the **private key**, which stays with you only;
* `id_ed25519.pub` – the **public key**, which we will put on the server.

> **Never share your private key.**
>
> The `id_ed25519` file is your private key. Do not send it in messengers, do not upload it to cloud storage and do not put it on the server.\
> Only the file ending in `.pub` ever leaves your computer.

***

### 3. Copy the key to the server

The command is run on your own computer. Replace `SERVER_IP` with the server's IP address.

#### macOS and Linux

```bash
# Copy the public key to the server for the user admin
ssh-copy-id admin@SERVER_IP
```
#### Windows (PowerShell)

```powershell
# Windows has no ssh-copy-id command, so we send the key in a
# single line. It creates the .ssh folder on the server, appends
# the key to authorized_keys and sets the right permissions
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh admin@SERVER_IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
```

The command will ask for the `admin` user's password. This is the last time you need it to log in.

***

### 4. Check key login

Connect from your computer in a **new** terminal window.

```bash
# Connect as the new user. The server password should not be
# requested, at most the key passphrase if you set one
ssh admin@SERVER_IP

# Once on the server, check that sudo works. The command should
# print root
sudo whoami
```

If you connect through Termius, add the key in its settings and set the user to `admin`. We showed how to connect through Termius in a [separate article](https://docs.f3cloud.com/en/vps/termius-connection.md).

***

### 5. Disable password login and root login

> **Do not close the old connection.**
>
> Keep your previous session open until you have made sure that key login works in a new window. If something goes wrong, you can easily put everything back through it.

On Ubuntu and Debian, SSH reads its settings from several files in the `/etc/ssh/sshd_config.d/` folder at once, and **the setting that comes first wins**. For example, the `50-cloud-init.conf` file may allow password login, and then your ban in another file simply will not work. That is why we will create our own file numbered `00`, so the server reads it before all the others.

From here on, the commands are run on the server.

```bash
# Create a file for our SSH settings and open it in the nano
# editor
sudo nano /etc/ssh/sshd_config.d/00-security.conf
```

Paste these lines into the file.

```ssh-config
# Do not allow logging in directly as root
PermitRootLogin no
# Do not allow password login
PasswordAuthentication no
# Keep key login enabled
PubkeyAuthentication yes
```

To save the file, press <kbd>Ctrl</kbd> + <kbd>O</kbd> and <kbd>Enter</kbd>, and to exit the editor, press <kbd>Ctrl</kbd> + <kbd>X</kbd>.

Now we will check the settings and apply them.

```bash
# Check the settings for errors. If the command prints nothing,
# everything is fine
sudo sshd -t

# See which settings are actually in effect
sudo sshd -T | grep -E "permitrootlogin|passwordauthentication"
```

The output should contain `permitrootlogin no` and `passwordauthentication no`. If you see a different value, another file is overriding it. Check what is in the folder with the `ls /etc/ssh/sshd_config.d/` command.

All that is left is to restart SSH.

#### Ubuntu and Debian

```bash
# Restart SSH so the new settings take effect
sudo systemctl restart ssh
```
#### AlmaLinux, CentOS, Oracle Linux

```bash
# Restart SSH so the new settings take effect
sudo systemctl restart sshd
```

***

### 6. Final check

Open one more terminal window and check both cases.

```bash
# Logging in as admin with the key should work
ssh admin@SERVER_IP

# Logging in as root should now end with a Permission denied
# error
ssh root@SERVER_IP
```

If that is what you see, congratulations, nobody can guess the password to your server any more. You can close the old session now.

> **If you lose access after all.**
>
> If you lose access after all, open the server with the <kbd>Console</kbd> button in the server list in your client area. The console opens the server right in your browser, without SSH, and you can undo the settings by deleting the `/etc/ssh/sshd_config.d/00-security.conf` file.

***

### Our resources

**Telegram channel:** [https://t.me/f3cloud_news](https://t.me/f3cloud_news)\
**F3 Cloud:** [https://f3cloud.com](https://f3cloud.com/en)