Use SSH keys for accountable VPS administration

Give each administrator an identity

SSH key authentication lets a server verify possession of a private key without sending that key across the network. Separate keys per person and device make onboarding, removal, and incident response more precise than one shared credential.

The exact HostGanga provisioning flow may differ by VPS product. Confirm whether keys can be injected during deployment or must be installed after first access, and always retain a tested recovery method before disabling password login.

Modern key choices

Use a current algorithm supported by your clients and server, with an adequate passphrase for portable keys.

Least-privilege access

Create named users, limit sudo rights, and avoid routine direct root login.

Lifecycle control

Maintain an owner inventory and promptly remove keys for lost devices, former staff, or completed vendors.

Install keys without exposing them

Generate the key pair on the administrator device. Only the public key belongs in the server authorized_keys file or provisioning form; the private key should remain protected on the device or approved key store. Verify file ownership and SSH permissions.

• Never email or paste a private key into a ticket
• Use one key per administrator or automation identity
• Test a second session before changing authentication settings

Prepare for loss and rotation

Document console or recovery access, keep more than one authorised administrator where appropriate, and rotate keys after suspected exposure. Automation keys should have narrow permissions and must not be reused across unrelated environments.

Frequently asked questions