> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rdp.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up SSH Keys

> Secure authentication with SSH keys instead of passwords

## Why SSH Keys?

SSH keys are more secure than passwords:

| Password                 | SSH Key                  |
| ------------------------ | ------------------------ |
| Can be guessed           | Virtually uncrackable    |
| Brute-force possible     | Brute-force impossible   |
| Must be entered manually | Automatic authentication |
| Can be intercepted       | Private key stays local  |

<Tip>
  After setup, you can connect without entering a password - faster and more secure!
</Tip>

***

## Create SSH Key

<Tabs>
  <Tab title="Windows">
    ### Windows 10/11 (PowerShell)

    <Steps>
      <Step title="Open PowerShell">
        Press `Win + X` and select **Windows Terminal** or **PowerShell**.
      </Step>

      <Step title="Generate SSH Key">
        ```powershell theme={null}
        ssh-keygen -t ed25519 -C "your@email.com"
        ```

        <Note>
          ED25519 is the most modern and secure algorithm. If your server doesn't support it, use RSA:

          ```powershell theme={null}
          ssh-keygen -t rsa -b 4096 -C "your@email.com"
          ```
        </Note>
      </Step>

      <Step title="Confirm Location">
        ```
        Enter file in which to save the key (C:\Users\YourName\.ssh\id_ed25519):
        ```

        Press **Enter** for the default location.
      </Step>

      <Step title="Set Passphrase (recommended)">
        ```
        Enter passphrase (empty for no passphrase):
        ```

        A passphrase adds extra protection to your key. You can also press Enter for no passphrase.
      </Step>

      <Step title="Copy Public Key">
        ```powershell theme={null}
        cat ~/.ssh/id_ed25519.pub
        ```

        Copy the entire output (starts with `ssh-ed25519`).
      </Step>
    </Steps>

    ### PuTTYgen (Alternative)

    <Steps>
      <Step title="Open PuTTYgen">
        Install [PuTTY](https://www.putty.org/) and open **PuTTYgen**.
      </Step>

      <Step title="Generate Key">
        1. Select **EdDSA** (or RSA with 4096 bits)
        2. Click **Generate**
        3. Move your mouse in the empty area for randomness
      </Step>

      <Step title="Save Keys">
        1. **Save private key** → Save as `.ppk` file
        2. Copy the text in the upper field (Public Key)
      </Step>
    </Steps>
  </Tab>

  <Tab title="macOS">
    ### Terminal

    <Steps>
      <Step title="Open Terminal">
        `Cmd + Space` → "Terminal"
      </Step>

      <Step title="Generate SSH Key">
        ```bash theme={null}
        ssh-keygen -t ed25519 -C "your@email.com"
        ```
      </Step>

      <Step title="Location and Passphrase">
        * Enter for default location (`~/.ssh/id_ed25519`)
        * Optional: Enter a passphrase
      </Step>

      <Step title="Add Key to SSH Agent">
        ```bash theme={null}
        eval "$(ssh-agent -s)"
        ssh-add ~/.ssh/id_ed25519
        ```

        For persistent storage, add to `~/.ssh/config`:

        ```
        Host *
          AddKeysToAgent yes
          UseKeychain yes
          IdentityFile ~/.ssh/id_ed25519
        ```
      </Step>

      <Step title="Copy Public Key">
        ```bash theme={null}
        cat ~/.ssh/id_ed25519.pub | pbcopy
        ```

        The key is now in your clipboard.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Linux">
    ### Terminal

    <Steps>
      <Step title="Generate SSH Key">
        ```bash theme={null}
        ssh-keygen -t ed25519 -C "your@email.com"
        ```
      </Step>

      <Step title="Location and Passphrase">
        * Enter for default location
        * Optional: Passphrase for extra security
      </Step>

      <Step title="Add Key to SSH Agent">
        ```bash theme={null}
        eval "$(ssh-agent -s)"
        ssh-add ~/.ssh/id_ed25519
        ```
      </Step>

      <Step title="Display Public Key">
        ```bash theme={null}
        cat ~/.ssh/id_ed25519.pub
        ```

        Copy the output.
      </Step>
    </Steps>
  </Tab>
</Tabs>

***

## Add Public Key to Server

Now you need to add your **Public Key** to the server.

### Method 1: ssh-copy-id (recommended)

The easiest way - works on macOS and Linux:

```bash theme={null}
ssh-copy-id root@YOUR-IP-ADDRESS
```

You'll be asked for the password once. After that, the key is set up.

### Method 2: Manual Copy

<Steps>
  <Step title="Log in with Password">
    ```bash theme={null}
    ssh root@YOUR-IP-ADDRESS
    ```
  </Step>

  <Step title="Create SSH Directory (if needed)">
    ```bash theme={null}
    mkdir -p ~/.ssh
    chmod 700 ~/.ssh
    ```
  </Step>

  <Step title="Add Public Key">
    ```bash theme={null}
    echo "YOUR-PUBLIC-KEY-HERE" >> ~/.ssh/authorized_keys
    chmod 600 ~/.ssh/authorized_keys
    ```

    Replace `YOUR-PUBLIC-KEY-HERE` with the copied key (starts with `ssh-ed25519` or `ssh-rsa`).
  </Step>

  <Step title="Test Connection">
    Open a new terminal and connect:

    ```bash theme={null}
    ssh root@YOUR-IP-ADDRESS
    ```

    <Check>
      If there's no password prompt, the key works!
    </Check>
  </Step>
</Steps>

***

## Disable Password Login

<Warning>
  First test that your SSH key works! Otherwise you'll lock yourself out.
</Warning>

After successful key setup, you can disable password login:

<Steps>
  <Step title="Edit SSH Configuration">
    ```bash theme={null}
    nano /etc/ssh/sshd_config
    ```
  </Step>

  <Step title="Change Settings">
    Find and change these lines:

    ```
    PasswordAuthentication no
    PubkeyAuthentication yes
    ```

    <Tip>
      Use `Ctrl + W` in nano to search.
    </Tip>
  </Step>

  <Step title="Restart SSH Service">
    ```bash theme={null}
    systemctl restart sshd
    ```
  </Step>

  <Step title="Test in New Terminal">
    Open a **new** terminal (keep the old one open!) and test:

    ```bash theme={null}
    ssh root@YOUR-IP-ADDRESS
    ```

    If it works, you can close the old terminal.
  </Step>
</Steps>

***

## Manage Multiple Keys

### SSH Config File

For multiple servers with different keys, create `~/.ssh/config`:

```
# RDP.sh Production Server
Host rdp-prod
    HostName 185.193.xxx.xxx
    User root
    IdentityFile ~/.ssh/id_ed25519

# RDP.sh Development Server
Host rdp-dev
    HostName 185.193.yyy.yyy
    User root
    IdentityFile ~/.ssh/id_ed25519_dev
    Port 2222

# Other Provider
Host other-server
    HostName example.com
    User admin
    IdentityFile ~/.ssh/other_key
```

Now you can simply connect with:

```bash theme={null}
ssh rdp-prod
ssh rdp-dev
```

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Permission denied (publickey)">
    **Possible causes:**

    * Public key not copied correctly
    * Wrong permissions on server
    * Wrong key being used

    **Solution:**

    ```bash theme={null}
    # Check permissions on server
    chmod 700 ~/.ssh
    chmod 600 ~/.ssh/authorized_keys

    # Check which key is being used
    ssh -v root@YOUR-IP
    ```
  </Accordion>

  <Accordion title="Agent has no identities">
    The SSH agent has no key loaded.

    **Solution:**

    ```bash theme={null}
    ssh-add ~/.ssh/id_ed25519
    ```
  </Accordion>

  <Accordion title="Key not accepted">
    **Check on server:**

    ```bash theme={null}
    cat ~/.ssh/authorized_keys
    ```

    The key must be on a single line and start with `ssh-ed25519` or `ssh-rsa`.
  </Accordion>

  <Accordion title="Forgot passphrase">
    Unfortunately, the passphrase cannot be recovered.

    **Solution:**

    1. Generate a new key
    2. Add the new public key to the server
    3. Delete the old key
  </Accordion>
</AccordionGroup>

***

## Best Practices

<CardGroup cols={2}>
  <Card title="🔐 Use a Passphrase" icon="lock">
    A passphrase protects your key if someone gains access to your computer.
  </Card>

  <Card title="🔄 Rotate Keys" icon="rotate">
    Regularly create new keys and remove old ones from authorized\_keys.
  </Card>

  <Card title="💾 Backup" icon="floppy-disk">
    Back up your private key in a secure location. Without it, you'll lose access!
  </Card>

  <Card title="🚫 Never Share" icon="ban">
    Never share your private key. Only the public key is copied to servers.
  </Card>
</CardGroup>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Configure Firewall" icon="shield" href="/docs/faq/ddos-protection">
    Protect your server with firewall rules
  </Card>

  <Card title="API Reference" icon="code" href="/docs/api-reference/introduction">
    Automate with our REST API
  </Card>
</CardGroup>