SSH keys & hardening

1. Create a key on your PC

ssh-keygen -t ed25519 -C "you@example.com"

Accept the default path. Copy the public key:

cat ~/.ssh/id_ed25519.pub

2. Install it on the server

ssh-copy-id root@<ip>
# or paste the .pub contents into ~/.ssh/authorized_keys

Test in a new terminal before you disable passwords:

ssh root@<ip>

3. Harden sshd

Edit /etc/ssh/sshd_config:

PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes

Apply:

systemctl restart ssh

DANGER

Do not close your current session until key login is confirmed in a new one. If you lock yourself out, use the panel's VNC/console to recover.

4. Optional extras

• fail2ban to ban brute-force IPs
• unattended-upgrades for security patches
• A non-root sudo user for day-to-day work

apt install fail2ban -y
systemctl enable --now fail2ban