Quick answer: SSH keys are the preferred way to access a VPS because they are harder to guess than passwords and easier to revoke. Password login can be useful during setup but should not be the long-term default for public servers.
Key Takeaways
- Use SSH keys for routine server access.
- Keep root access limited and documented.
- Create individual accounts when more than one person needs access.
- Store key locations and recovery steps privately.
Why SSH keys are safer
A password can be guessed, reused, phished, or leaked. An SSH key uses a public key on the server and a private key on your device, which makes automated guessing far less useful.
The private key must still be protected. Use a passphrase where appropriate and keep backups in a secure location.
- Public key goes on the server.
- Private key stays on your device.
- Passphrases add protection if a device is lost.
- Keys can be removed when access changes.
Root login and named users
Root login is common during early server creation. Over time, named users make access easier to audit and revoke, especially when more than one person touches the server.
For a solo operator, root plus a protected key may be acceptable for a simple VPS. For teams, create named users and use privilege escalation for admin tasks.
- Solo server: keep root key safe and documented.
- Team server: create individual users.
- Remove old keys immediately.
- Avoid sending private keys through chat.
Operational access notes
Access problems usually happen months after setup, when nobody remembers where the key is or which user was used. A private access note prevents that.
The note should include server IP, hostname, provider console, login user, key filename, and emergency recovery steps. Do not put private key contents in a shared document unless the document is designed for secrets.
- Server IP and hostname.
- Login user.
- SSH key filename.
- Provider console recovery path.
Implementation Checklist
- Generate a dedicated SSH key for the server.
- Confirm key-based login works.
- Document access privately.
- Review users and keys every quarter.
Frequently Asked Questions
Should I disable password SSH login?
For a public server, key-based login is safer. Disable password login after you have confirmed key access and recovery options.
Can one SSH key be used on multiple servers?
It can, but dedicated keys are easier to rotate and revoke when a device or project changes.