SSH keys and multi-user VPS hygiene

Password authentication over SSH is still too common. On a VPS that multiple people can access, key-only authentication and basic user hygiene prevent an entire class of incidents.

Minimum practice

• Disable password login for SSH.
• Use ed25519 or equivalent modern keys.
• Give each person their own account rather than sharing root.
• Use sudo for privileged actions and keep an audit trail.
• Remove keys promptly when someone leaves the project.

Common failures

• A single shared key that is never rotated.
• Root login still enabled “for convenience.”
• Old keys left in authorized_keys after a contractor finishes.
• No central record of who has access.

When a key is compromised, the blast radius is determined by how the accounts were set up. Separate users and limited sudo make containment possible. A single shared root key makes every past holder a permanent risk.

Host role

We can enforce key-only policies at the image level and provide guidance. The ongoing key management belongs to the customer. Snapshots help recovery; they do not replace access hygiene.

A few minutes of setup when the VPS is created saves hours of incident response later.

---