How to Create & Add SSH Keys (Ed25519) to a Server

SSH keys let you log in without a password and are far harder to attack than one. You’ll create an Ed25519 key pair on your computer, register the public key with PowerDedi and install it on servers that are already running. All you need is a terminal: Terminal on Linux and macOS, or PowerShell on Windows 10 and 11.

How SSH keys work

A key pair has two halves. The private key stays on your computer, protected by a passphrase, and is never shared. The public key is a single line of text that you can copy anywhere: into the client area or into a server’s ~/.ssh/authorized_keys file. Ed25519 keys are short, fast and supported by every operating system we install.

If an older service accepts only RSA, create an RSA key with ssh-keygen -t rsa -b 4096. With a FIDO2 hardware security key, ssh-keygen -t ed25519-sk keeps the private key on the device.

Generate a key on Linux or macOS

ssh-keygen -t ed25519 -C "alice-laptop"

Accept the default location, ~/.ssh/id_ed25519, and choose a passphrase. The comment after -C only helps you recognize the key later. Then display the public key, which you’ll paste in the next steps:

cat ~/.ssh/id_ed25519.pub

To avoid typing the passphrase for every connection, load the key into the SSH agent once per session with ssh-add ~/.ssh/id_ed25519. On macOS, ssh-add --apple-use-keychain ~/.ssh/id_ed25519 also stores the passphrase in your keychain.

Generate a key on Windows

Windows 10 and 11 include the OpenSSH client. If PowerShell can’t find ssh-keygen, add OpenSSH Client under Optional features in Settings. Then, in PowerShell:

ssh-keygen -t ed25519 -C "alice-laptop"
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

The key pair is saved in C:\Users\<you>\.ssh\. To use the agent, run the first two commands below in an elevated PowerShell window, and the last one as yourself:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

Add the key to the client area

Open Account → SSH keys and add a new key.
Paste the whole public key line, from ssh-ed25519 to the comment, and give it a name you’ll recognize.
Select the key when you order a server, reinstall one or enable rescue mode.

Keys saved in the client area are installed when a server is set up, reinstalled or booted into rescue mode. They are not pushed to servers that are already running: add them there yourself, as described below.

Add a key to a running server

From Linux or macOS, ssh-copy-id appends the key and sets the right permissions:

ssh-copy-id -i ~/.ssh/id_ed25519.pub alice@203.0.113.10

Windows has no ssh-copy-id. This PowerShell line does the same job:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh alice@203.0.113.10 "umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys"

To do it by hand on the server, put the key on its own line in ~/.ssh/authorized_keys and set strict permissions. The SSH server ignores keys when the directory or the file is writable by other users:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
vi ~/.ssh/authorized_keys          # paste the key, one key per line
chmod 600 ~/.ssh/authorized_keys

On AlmaLinux and Rocky Linux, if a correct key is still refused, restore the SELinux labels with restorecon -Rv ~/.ssh.

Shorten logins with ~/.ssh/config

A host entry saves you from typing addresses, usernames and key paths. On Windows, the file is C:\Users\<you>\.ssh\config and uses the same syntax:

Host pd-fra1
    HostName 203.0.113.10
    User alice
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Now ssh pd-fra1 connects, and scp, rsync and Git use the same entry. IdentitiesOnly yes stops SSH from offering every key in your agent, which avoids “Too many authentication failures” errors.

Use your key with PuTTY

PuTTY uses its own .ppk key format. Open PuTTYgen, choose Conversions → Import key, select your id_ed25519 file, enter its passphrase and click Save private key. In PuTTY, select the .ppk file under Connection → SSH → Auth → Credentials. If you generated the key in PuTTYgen instead, copy the text from the box labeled “Public key for pasting into OpenSSH authorized_keys file” into the client area.

Remove a key you no longer trust

If a laptop is lost or a colleague leaves, revoke that key: delete its line from ~/.ssh/authorized_keys on every server, for every user including root, and remove it from Account → SSH keys. If it was your own key, install a new one first so that you keep access.

Create and use SSH keys