This guide shows you how to create an SSH key and add it to an existing BinaryLane Ubuntu Cloud Server. After you confirm that the key works, you can optionally disable password authentication.


These steps apply to BinaryLane Ubuntu 24.04 LTS and Ubuntu 26.04 LTS Cloud Servers. They do not reinstall or reboot the server. Your existing password login continues to work unless you complete the optional section to disable it.


If you want a key selected automatically when you deploy a new server, see Set a default SSH key for all new Cloud Server installations. That setting does not add the key to existing servers.


Before you begin


Prerequisites: 

  • the public IP address of your Cloud Server;
  • access to the server using its existing password, an existing SSH key or the mPanel web console; and
  • PowerShell on Windows, Terminal on macOS, or a terminal on Linux.


Replace YOUR_SERVER_IP in each command with your server's public IP address. If the server uses a login account other than root, replace root with that username.


Important: The server's operating system and SSH configuration are customer-managed. Keep an existing session open while testing access so that you can undo a change if required.

 


TABLE OF CONTENTS


1. Create an SSH key on your computer


An SSH key pair contains:


FilePurposeWhere it belongs
id_ed25519Private keyKeep it on your computer. Never share it.
id_ed25519.pubPublic keyCopy it to the server. It is safe to share.


Ed25519 is the recommended key type for current Ubuntu releases. Run the command for your computer:

Windows


Open PowerShell and run:


ssh-keygen -t ed25519 -C "your-email@example.com"

Press Enter to use the default file location. Enter a passphrase when prompted to protect the private key, or press Enter twice to create the key without one.

The default files are:


C:\Users\YOUR_USERNAME\.ssh\id_ed25519
C:\Users\YOUR_USERNAME\.ssh\id_ed25519.pub


Copy the public key to the clipboard:


Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard

macOS


Open Terminal and run:


ssh-keygen -t ed25519 -C "your-email@example.com"


Press Enter to use the default file location. Enter a passphrase when prompted, or press Enter twice to create the key without one.

Copy the public key to the clipboard:


pbcopy < ~/.ssh/id_ed25519.pub


Ubuntu or another Linux distribution


Open a terminal and run:


ssh-keygen -t ed25519 -C "your-email@example.com"


Press Enter to use the default file location. Enter a passphrase when prompted, or press Enter twice to create the key without one.

Display the public key so that you can copy it:


cat ~/.ssh/id_ed25519.pub


A public key is one continuous line beginning with ssh-ed25519, for example:


ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOroI0Z8ytEtHwTalX+nHBcM7eI4K/zy6szqWXCUJnaw your-email@example.com


If a key already exists: Do not overwrite id_ed25519 unless you are certain that nothing else uses it. You can reuse the existing key, or run ssh-keygen with -f and a different filename to create a separate key.



2. Install the public key on the server


Use one of the following methods. Both append the public key to ~/.ssh/authorized_keys, so existing keys remain in place.

Option A: Copy the key over SSH


Use this method if you can still log in with the server's password.

Windows PowerShell


Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR_SERVER_IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"


macOS or Linux


ssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR_SERVER_IP


Enter the server's password when prompted. On macOS or Linux, a successful ssh-copy-id command reports the number of keys added.

Option B: Paste the key manually


Use this method from the mPanel web console or an existing SSH session.


  1. Copy the contents of id_ed25519.pub from your computer.
  2. On the server, create the SSH directory and set its permissions:

    mkdir -p ~/.ssh && chmod 700 ~/.ssh


  3. Open the authorised keys file:
    nano ~/.ssh/authorized_keys


  4. Paste the public key on its own line. It must remain one continuous line beginning with ssh-ed25519.

  5. Press Ctrl+O, Enter, then Ctrl+X to save and exit.

  6. Set the correct file permissions:

    chmod 600 ~/.ssh/authorized_keys


OpenSSH may reject an authorised keys file if its ownership or permissions allow another account to modify it.

Confirm the key was added


On the server, display the fingerprints of the installed keys:

ssh-keygen -lf ~/.ssh/authorized_keys


Your new key's fingerprint and comment should appear in the output.


3. Test the key


Leave your existing server session open. Open a second terminal and connect with the new key.


On macOS or Linux:


ssh -i ~/.ssh/id_ed25519 root@YOUR_SERVER_IP


On Windows PowerShell:


ssh -i $env:USERPROFILE\.ssh\id_ed25519 root@YOUR_SERVER_IP


If the key has a passphrase, enter the key's passphrase. This is different from the server's account password.



Do not continue until the key login succeeds. If it fails, use the original session to check the username, key and permissions. For more connection guidance, see How do I connect to my Cloud Server using my SSH key?


4. Disable password authentication (optional)



Warning: Incorrect SSH configuration can lock you out of the server. Complete this section only after the key login in step 3 succeeds, and keep the working session open until all verification steps are complete.


Ubuntu reads additional OpenSSH server settings from /etc/ssh/sshd_config.d/*.conf. OpenSSH uses the first value it obtains for each setting, and included files are processed in lexical filename order. On BinaryLane Ubuntu images, 10-binarylane.conf sets authentication defaults. A custom file beginning with 01- is therefore read first.

  1. Create a drop-in file:

    sudo nano /etc/ssh/sshd_config.d/01-disable-password-auth.conf


  2. Add these lines:

    PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password


  3. Press Ctrl+O, Enter, then Ctrl+X to save and exit.

  4. Check the complete configuration for syntax errors:

    sudo sshd -t


    No output means the syntax check passed. If an error appears, correct it before continuing.

  5. Confirm the effective settings:

    sudo sshd -T | grep -Ei '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin) '


    The output should include:

    permitrootlogin prohibit-password
passwordauthentication no
kbdinteractiveauthentication no


  6. Apply the change:
    sudo systemctl restart ssh


Restarting the SSH service does not normally disconnect established sessions.

Verify password authentication is disabled


With the working session still open, use a new terminal to attempt a connection without public-key authentication:

ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password,keyboard-interactive root@YOUR_SERVER_IP


The connection should fail with Permission denied (publickey). Then confirm that the key still works:

ssh -i ~/.ssh/id_ed25519 root@YOUR_SERVER_IP


Undo the change


From the original session, disable the custom file and restart SSH:

sudo mv /etc/ssh/sshd_config.d/01-disable-password-auth.conf /etc/ssh/sshd_config.d/01-disable-password-auth.conf.disabled
sudo sshd -t && sudo systemctl restart ssh



Recover access if the private key is lost


A private key cannot be recovered from the public key on the server. If password authentication is disabled and you lose the private key or its passphrase, use the Rescue Console to enable password-based logins to regain access: Remove an SSH key and re-enable password logins on an Ubuntu VPS



Things to know


  • Back up the private key securely. It cannot be regenerated from the public key.
  • Copy only the .pub file to a server. Never upload or share the private key.
  • Adding a key does not remove existing keys. To remove a key, delete only its complete line from authorized_keys.
  • SSH keys are configured per user. Add the key to the home directory of the account you use to log in.
  • Adding a key manually affects only that server and user account.



If you require assistance, feel free to submit a support ticket at our helpdesk here: Submit a ticket | BinaryLane