Putting your key on the server and testing it

Did you already paste a key during installation? Then it is already there for root. If not, add it now. Do this for every user who needs to log in with a key.

From a Mac or Linux

ssh-copy-id root@203.0.113.10

You type the server password once. The program puts your public key in the file ~/.ssh/authorized_keys on the server and sets the permissions correctly.

From Windows

ssh-copy-id does not exist on Windows. In PowerShell you can do the same with a single line:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@203.0.113.10 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

By hand

You can also add the line to the file yourself, for example via the console. Open the file in the nano editor, paste the line and save with Ctrl+O and Enter, then close with Ctrl+X:

root@web1:~# mkdir -p ~/.ssh && chmod 700 ~/.ssh
root@web1:~# nano ~/.ssh/authorized_keys
root@web1:~# chmod 600 ~/.ssh/authorized_keys

One key per line. The permissions matter: if the folder or the file is writable by others, the SSH server ignores your key.

Testing

Open a new terminal window and log in. You can even force SSH to try only the key:

ssh -o PreferredAuthentications=publickey root@203.0.113.10

If you get in without the server password (at most your passphrase), your key works. Only then continue with Disabling password login and root login.

Removing a key

Lost a laptop, or has a colleague left? Open ~/.ssh/authorized_keys and delete the line with the name of that key (the part after the long code, such as anna laptop). This applies straight away to new connections.