How to replace password-based SSH authentication with key-based

Secure your SSH access by setting up key-based authentication first and disabling password-based access afterward. Follow this guide carefully to avoid locking yourself out.

Step 1: Add your public key to the server

Before disabling passwords, make sure your public key is already working. Follow the How to Add a New SSH Key to a Cloud Server article.

Verify key-based login works before proceeding:

ssh -i ~/.ssh/id_ed25519 username@server_ip

Step 2: Disable password authentication in SSH config

Open the SSH daemon configuration file:

sudo nano /etc/ssh/sshd_config

Find and update (or add) these lines:

PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

Also ensure root password login is disabled if not needed:

PermitRootLogin prohibit-password

Step 3: Restart the SSH daemon

Apply the changes by restarting sshd:

# Debian/Ubuntu
sudo systemctl restart ssh

# CentOS/RHEL
sudo systemctl restart sshd

Step 4: Verify in a new session

Do not close your current session. Open a new terminal and confirm you can still log in with your key:

ssh -i ~/.ssh/id_ed25519 username@server_ip

If it works, the configuration is complete. Only then close your previous session.

Troubleshooting

If you get locked out, use the server's VNC console in the Customer Portal to regain access and revert the changes.