SSH Keys, VPS Security & Server Hardening

Your server is on the internet 24/7. Here's how to make sure only you can get in.

The Simple Version

Imagine you rent a small office in a building downtown. It's yours, but it's in a shared building — anyone can walk up to the door. You need a lock.

A password is like a combination lock. Anyone who guesses the right numbers can get in. And people are trying — thousands of times a day, automatically.

An SSH key is more like a special two-part key system. You have a private key that never leaves your pocket, and a matching lock (the public key) installed on your office door. Only your key opens that lock. Nobody can guess it, copy it, or brute-force it.

A VPS (Virtual Private Server) is that rented office. It's a computer sitting in a data center somewhere — always on, always connected. And because it's always online, people are constantly rattling the doorknob.

Server hardening is everything you do beyond just having a good lock: removing the doorbell so strangers can't ring it, boarding up windows you don't use, and telling building security to only let in people who show the right key — no exceptions.

How It Actually Works

SSH Keys: The Math Behind the Magic

When you run ssh-keygen, your computer creates two files:

• Private key (~/.ssh/id_ed25519) — stays on your machine, never shared. This is your actual key.
• Public key (~/.ssh/id_ed25519.pub) — gets copied to every server you want to access. This is the lock.

When you connect, the server sends a challenge that only your private key can answer. The private key never travels over the network — it just proves it exists. The algorithm (Ed25519) is based on elliptic curve cryptography, and cracking it would take longer than the age of the universe.

You protect the private key with a passphrase — a password that encrypts the key file itself. On macOS, you store this in Keychain so you don't type it every time.

Your SSH Config: Shortcuts

Instead of typing ssh root@203.0.113.10 every time, set up ~/.ssh/config:

Host my-server
  HostName 203.0.113.10
  User root

Host *
  UseKeychain yes
  AddKeysToAgent yes
  IdentityFile ~/.ssh/id_ed25519Copy

Now ssh my-server does the same thing. The wildcard Host * block applies your key and Keychain settings to all connections.

Server Hardening: Locking Down the Doors

Once your key is in place, harden the server by editing /etc/ssh/sshd_config:

# Block all password login attempts
PasswordAuthentication no

# Root can only log in with a key
PermitRootLogin without-passwordCopy

Then restart SSH:

systemctl restart sshCopy

Watch for override files. Cloud providers drop configs into /etc/ssh/sshd_config.d/ that can silently re-enable password auth. Always check:

grep -r 'PasswordAuthentication' /etc/ssh/sshd_config.d/Copy