Connecting to your VPS with SSH and improving security

Updated: 28 September 2026 · Applies to: AlmaLinux 9, Rocky Linux 9, Ubuntu 24.04 and Debian 12

When your VPS is ready, we send a welcome email with its main IP address, the username (root) and the root password. This guide shows how to log in over SSH and then make logins safer with an SSH key.

1. Connect

On Linux, macOS, and Windows 10 or 11, open a terminal (on Windows, PowerShell or Windows Terminal) and run:

ssh root@your-server-ip

The first time, type yes to accept the server's host key, then enter the root password from the welcome email. On Windows you can also use PuTTY.

2. Update the server and change the root password

# AlmaLinux, Rocky Linux
dnf -y update

# Ubuntu, Debian
apt update && apt -y upgrade

# then, on any system
passwd

3. Log in with an SSH key

On your own computer (not on the server), create a key and set a passphrase when asked:

ssh-keygen -t ed25519

Copy the public key to the server:

ssh-copy-id root@your-server-ip

On Windows, where ssh-copy-id is not available, add the contents of %USERPROFILE%\.ssh\id_ed25519.pub as a new line in /root/.ssh/authorized_keys on the server.

Open a new terminal and run ssh root@your-server-ip again. It should log you in with the key, asking only for the key's passphrase.

4. Turn off password logins

Do this only after the key login works. On the server, open /etc/ssh/sshd_config and set:

PasswordAuthentication no
PermitRootLogin prohibit-password

Check the settings the SSH server will actually use:

sshd -T | grep -Ei "passwordauthentication|permitrootlogin"

You should see passwordauthentication no and permitrootlogin prohibit-password (shown as without-password on some versions). If not, a file in /etc/ssh/sshd_config.d/ sets a different value; change it there. Then restart the SSH server:

# AlmaLinux, Rocky Linux
systemctl restart sshd

# Ubuntu, Debian
systemctl restart ssh

Keep your current session open and test the login in a new terminal before you close it.

5. More protection

• Keep the system updated regularly (step 2).
• Install fail2ban to block addresses that repeatedly fail to log in. It is in the Ubuntu and Debian repositories, and in EPEL on AlmaLinux and Rocky Linux.
• Open only the ports your applications need in the firewall.

If you ever lock yourself out, use the VNC console in the VPS control panel (the link is in the welcome email) to log in and correct the SSH configuration.