Connect to Your VPS over SSH and Configure It

SSH is the front door of a Linux VPS: everything is administered from this encrypted console. This guide covers the first connection from Windows, macOS or Linux, the move to keys, then the settings that make access genuinely safe.

⚙️ Requirements

• A Lordhosting Linux VPS, started from the panel
• Its IP address and the root password given on delivery
• A terminal: PowerShell, macOS Terminal or any Linux shell

⚙️ 1. First connection

The command is identical on all three systems:

ssh [email protected]

If your server listens on another port, state it with -p:

ssh -p 2222 [email protected]

On the first connection, SSH shows the machine fingerprint and asks for confirmation. Answer yes: the fingerprint is stored, and any later change triggers a warning.

⚙️ 2. Create a key pair

On your machine, not on the server:

ssh-keygen -t ed25519 -C "main-workstation"

Accept the suggested path and enter a passphrase: it protects the key if your workstation is compromised. Two files appear in ~/.ssh:

• id_ed25519 - the private key, which never leaves your machine
• id_ed25519.pub - the public key, to install on the server

⚙️ 3. Install the key on the server

The simplest route, from Linux or macOS:

ssh-copy-id [email protected]

On Windows, in PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh [email protected] "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Then check that the connection works without a password before going further. This step is not optional: what follows disables passwords.

⚙️ 4. Create an unprivileged user

Living as root multiplies the damage of a single typo:

adduser alex
usermod -aG sudo alex
rsync --archive --chown=alex:alex ~/.ssh /home/alex

The last line copies your key over for the new user. Test ssh [email protected], then sudo -v, before moving on.

⚙️ 5. Harden the server configuration

Edit /etc/ssh/sshd_config:

Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowUsers alex

These six lines remove most of the attack surface: no direct root, no passwords, a port outside the usual scans.

Then reload the service without closing your session:

sudo sshd -t && sudo systemctl reload ssh

sshd -t validates the syntax: if it reports an error, fix it before reloading. Open a second terminal to test the new configuration; your current session is your safety net.

⚙️ 6. Simplify with a config file

On your workstation, ~/.ssh/config saves retyping options:

Host vps
    HostName 203.0.113.42
    User alex
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Connecting becomes ssh vps. The same alias works for scp and sftp.

⚙️ 7. Fix the common errors

• Permission denied (publickey): the public key is not in ~/.ssh/authorized_keys, or the permissions are too loose (chmod 700 ~/.ssh, chmod 600 ~/.ssh/authorized_keys).
• Connection refused: service stopped, wrong port, or firewall. Use the panel's VNC console.
• Connection timed out: wrong address, or no rule allows the port.
• REMOTE HOST IDENTIFICATION HAS CHANGED: a reinstall, or a different machine. Run ssh-keygen -R <address>.

⚙️ Ready-to-paste configuration

Rather than editing sshd_config line by line, drop in an override file: it survives package updates and can be removed with a single rm.

# /etc/ssh/sshd_config.d/99-hardening.conf
Port 2222
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
MaxAuthTries 3
MaxSessions 4
LoginGraceTime 20
AllowUsers alex
X11Forwarding no
AllowAgentForwarding no
PrintMotd no
ClientAliveInterval 300
ClientAliveCountMax 2

The script that writes that file, opens the port and validates before reloading - replace the two variables:

#!/usr/bin/env bash
# SSH hardening, ready to run. Execute as root, without closing your session.
set -euo pipefail

USERNAME="alex"   # the account allowed to connect
SSH_PORT="2222"   # the new port

# The port must be open BEFORE the service is reloaded
command -v ufw >/dev/null && ufw allow ${SSH_PORT}/tcp comment 'SSH'

cat > /etc/ssh/sshd_config.d/99-hardening.conf <<CONFIG
Port ${SSH_PORT}
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
MaxAuthTries 3
LoginGraceTime 20
AllowUsers ${USERNAME}
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
CONFIG

# Safety net: a syntax error stops the script before the reload
sshd -t
systemctl reload ssh
echo "Reloaded. Now test from a SECOND terminal:"
echo "  ssh -p ${SSH_PORT} ${USERNAME}@\$(curl -s ifconfig.me)"

On your workstation, this block in ~/.ssh/config saves retyping the options on every connection:

Host vps
    HostName 203.0.113.42
    User alex
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ServerAliveInterval 60

Connecting becomes ssh vps, and scp file vps:/tmp/ works with the same alias.

✅ Conclusion

You connect with a key, under an unprivileged account, to a service that refuses passwords. That is the foundation for everything else: continue with full VPS hardening and the UFW firewall.

Our Linux VPS plans ship with root access, a rescue VNC console and your choice of distribution at deployment.