Managing SSH keys

Generating an SSH key pair

We recommend Ed25519 keys — they are shorter, faster, and more secure than RSA 2048:

ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519_virteche

• Private key (id_ed25519_virteche): stays on your machine. Never share it.
• Public key (id_ed25519_virteche.pub): upload this to your server.

Adding a key to an existing server

# From your local machine
ssh-copy-id -i ~/.ssh/id_ed25519_virteche.pub root@YOUR_VPS_IP

# Or manually:
cat ~/.ssh/id_ed25519_virteche.pub | ssh root@YOUR_VPS_IP "cat >> ~/.ssh/authorized_keys"

Connecting with a specific key

ssh -i ~/.ssh/id_ed25519_virteche deploy@YOUR_VPS_IP

Add a shortcut to ~/.ssh/config:

Host myserver
  HostName YOUR_VPS_IP
  User deploy
  IdentityFile ~/.ssh/id_ed25519_virteche
  IdentitiesOnly yes

Then connect with just: ssh myserver

Revoking a key

Remove the relevant line from ~/.ssh/authorized_keys on the server:

nano ~/.ssh/authorized_keys
# Delete the line containing the key to revoke

Key rotation best practice

Rotate SSH keys every 12 months or immediately after:

• A team member leaves
• A machine that had the private key is compromised
• The private key file is accidentally exposed