How do I set up SSH keys and lock down SSH on my dedicated server?

Passwords get guessed; keys don't. Ten minutes to set up, and the bots lose interest.

Steps

This is for Linux. Keep your current SSH session open until the last step, so a typo can't lock you out. You'll need your Main IP.

1. On your own computer, create a key: ssh-keygen -t ed25519. Set a passphrase when asked.
2. Copy the public key to the server: ssh-copy-id -o User=USERNAME YOUR.MAIN.IP (replace USERNAME with your login).
3. Open a second terminal and confirm the key works: ssh -l USERNAME YOUR.MAIN.IP. It should ask for your key passphrase, not the account password.
4. On the server, open /etc/ssh/sshd_config in an editor such as sudo nano /etc/ssh/sshd_config.
5. Set PasswordAuthentication no.
6. Set PermitRootLogin prohibit-password, or no if you log in as a normal user and use sudo.
7. Test the configuration: sudo sshd -t. No output means no errors.
8. Reload SSH: sudo systemctl reload sshd (on Debian or Ubuntu the service may be named ssh).
9. From a third terminal, confirm you can still log in with your key. Only then close your original session.

If it didn't work

• Locked out? Use the IPMI console (see our article on reaching IPMI) to log in locally, fix /etc/ssh/sshd_config, and reload.
• "Permission denied (publickey)": check that ~/.ssh is mode 700 and ~/.ssh/authorized_keys is mode 600 on the server.
• Some Ubuntu releases don't allow direct root login by default; log in as the normal user and use su or sudo.
• Still stuck? Open a ticket in the portal, set Department to Technical Support, and include your Main IP and the exact error. Unmanaged servers get guidance only; hands-on work follows the unmanaged support terms.