SSH keys instead of passwords

SSH keys let you sign in without typing a password on every connection. You keep a private key on your computer and place the matching public key in authorized_keys on the server. A passphrase on the private key protects it if the file is copied. Generate an ed25519 key, prove a second login works, then turn off password SSH so bots stop guessing on port 22.

Create the key on your computer

Generate the pair on your own machine, not on the server. That keeps the private half off the host from the start.

ssh-keygen -t ed25519 -C ‘you@logicweb’

The command writes id_ed25519 and id_ed25519.pub under your ~/.ssh folder. The comment after -C is only a label so you can tell keys apart later. Protect the private file and never email it or paste it into chat. Copy only the single line from the .pub file into cPanel SSH Keys on shared hosting, or into ~/.ssh/authorized_keys on a VPS. Set mode 600 on that file and 700 on the .ssh directory. Open a second terminal and log in with the key before you change any SSH daemon settings.

Finish keys before you leave passwords on

Leaving PermitRootLogin yes and PasswordAuthentication yes “until setup is done” is the window scanners use. They do not wait for you to finish. Complete key login first, using the provider console if you must, then disable passwords. One key per person works better than a shared key pasted into Slack. Revoke the public line when someone leaves the project.

Turn off password SSH safely

On a VPS you control sshd. Set PasswordAuthentication no and prefer PermitRootLogin no, or prohibit-password only if you must allow root with a key. Give each person a sudo user. Confirm console, VNC, or IPMI access before you save and reload sshd. On shared hosting you do not edit sshd; you add keys in cPanel and use SFTP with a key instead of the account password in FileZilla when you can.

Firewall rules come after you still have a working way in. Keys on port 22 are already a solid baseline. Moving the port is optional and does not replace key-only login. Windows users can use OpenSSH in PowerShell or a current PuTTY build with an ed25519 key. Do not convert the private key to a .ppk and mail it to yourself. If a contractor needs SFTP, give them their own key and a limited directory, then remove their .pub line on the last day. Your authorized_keys file should stay a short list you can read and recognize.