# How do I generate an SSH key for my VPS?

> Generate an Ed25519 SSH key in 4 steps and paste it at checkout. A Gloamport Ember VPS costs $3.74 a month on 12 months.

- URL: https://gloamport.com/guides/how-to-generate-an-ssh-key/
- Last updated: 2026-11-10
- Publisher: Gloamport (https://gloamport.com)

One command makes the key pair. The public half goes to the server, the private half never leaves your machine.

**Quick answer — How do I generate an SSH key for my VPS?**

To generate an SSH key for your VPS, run ssh-keygen -t ed25519 -C "label" -f ~/.ssh/gloamport_ed25519, set a passphrase, then paste the .pub file at checkout. On Gloamport the key is optional, and an Ember plan costs $3.74 a month on 12 months.

## Which files does ssh-keygen create?

| File | What it is | Who may see it |
| --- | --- | --- |
| `~/.ssh/gloamport_ed25519` | Private key (the name you pass with `-f`) | Only you. Never paste it anywhere |
| `~/.ssh/gloamport_ed25519.pub` | Public key, the same name with `.pub` added | Anyone; this is what you give the VPS |
| `~/.ssh/authorized_keys` on the VPS | List of public keys allowed to log in | Root on the VPS |

File naming follows the ssh-keygen(1) manual: the public key has `.pub` appended to the private key name.

## Why use an SSH key instead of a password?

An SSH key beats a password because it cannot be guessed over the network and is never sent to the server. The server holds only the public half, and login proves you own the private half.

On Gloamport, Root over SSH. Paste a public key at checkout and password login stays switched off; leave it empty and the team sets a temporary root password, shown in your dashboard, that you change at first login. According to Gloamport's survey of 10 November 2026, 28 of 49 entries state that no identity document is asked at sign-up, so for many servers the SSH key is the only credential tied to the machine. Treat it that way.

## How do I generate an SSH key, step by step?

Four steps on your own computer, then one at checkout.

1. **Run ssh-keygen** — Use -t ed25519, which is the default type, with -C for a label and -f for the file name.
2. **Choose a passphrase** — Enter a passphrase when asked. It encrypts the private key on your disk, so a stolen file is not enough.
3. **Print the public key** — Display the .pub file with cat and copy the single line.
4. **Paste it at checkout** — Paste the line into the SSH key field when you order. The key is optional: leave it empty and you get a temporary root password to change at first login.
5. **Log in** — Connect with ssh -i and the private key path once the dashboard shows the IP address.

## What is the exact ssh-keygen command?

The command is `ssh-keygen -t ed25519 -C "label" -f ~/.ssh/gloamport_ed25519`. The manual states that ed25519 is the default type, that `-C` sets the comment (initialised to user@host), that `-f` names the key file, and that the key derivation function uses 16 rounds by default (`-a`).

*Generate the key pair*

```bash
ssh-keygen -t ed25519 -C "gloamport-vps" -f ~/.ssh/gloamport_ed25519
```

*Show the public key and its fingerprint*

```bash
cat ~/.ssh/gloamport_ed25519.pub
ssh-keygen -l -f ~/.ssh/gloamport_ed25519.pub
```

## How do I put the key on a VPS I already have?

If the VPS already exists and you can log in with a password, use `ssh-copy-id`. The manual says it appends your public key to the remote user's `~/.ssh/authorized_keys` and creates the file and directory if they are missing. Use `-i` to name the key.

*Copy the key and log in*

```bash
ssh-copy-id -i ~/.ssh/gloamport_ed25519.pub root@YOUR_VPS_IP
ssh -i ~/.ssh/gloamport_ed25519 root@YOUR_VPS_IP
```

> **Keep a copy of the key** Write the account number down somewhere safe: it is the one key to the account. With an email on file, a forgotten number can be sent to that address; without one, nobody at Gloamport can bring it back. The same logic applies to the SSH key: keep an encrypted backup of the private key, because a lost private key cannot be rebuilt from the public one.

## What do I do after the first login?

Close the doors you do not need. Your first job on the new server is to stop password logins and restrict who can log in, which is covered in [How do I harden SSH on a new VPS?](https://gloamport.com/guides/how-to-harden-ssh-on-a-vps/ "How do I harden SSH on a new VPS?").

If you have not ordered yet, [How do I buy a VPS with Monero (XMR)?](https://gloamport.com/buy-vps-with-monero/ "How do I buy a VPS with Monero (XMR)?") walks through the payment, and [Can I get a VPS without an email address?](https://gloamport.com/vps-without-email/ "Can I get a VPS without an email address?") explains the account number. Ember starts at $7.48 a month, or $3.74 a month on 12 months; see [the pricing page](https://gloamport.com/pricing/ "How much does a Gloamport VPS cost?").

**In summary**

- Use `ssh-keygen -t ed25519`; ed25519 is the default key type.
- Name the file with `-f` and add a label with `-C`.
- Set a passphrase so the private key is encrypted on disk.
- Give the VPS only the `.pub` file.
- At Gloamport the SSH key is optional at checkout.
- `ssh-copy-id -i` adds a key to an existing server.
- Ember costs $3.74 a month on 12 months.

## SSH keys for a VPS: common questions

### Which key type should I choose?

Ed25519. The ssh-keygen manual lists it as the default type, and it gives short keys that are easy to paste at checkout.

### Do I have to set a passphrase?

It is optional, but recommended. The passphrase encrypts the private key file, so a copied file cannot be used without it.

### What if I leave the SSH key field empty at Gloamport?

The team sets a temporary root password, shown in your dashboard. You change it at first login, and a key can be added later.

### How do I see a key fingerprint?

Run `ssh-keygen -l -f` with the path of the public key. The `-l` option shows the fingerprint of the key file.

### Can I use the same key for several servers?

Technically yes, but one key per purpose limits the damage if it leaks. Generate a new file name with `-f` for each group of servers.

## Sources

1. [ssh-keygen(1) manual page](https://manpages.debian.org/trixie/openssh-client/ssh-keygen.1.en.html) — Debian (checked 2026-11-10)
2. [ssh-copy-id(1) manual page](https://manpages.debian.org/trixie/openssh-client/ssh-copy-id.1.en.html) — Debian (checked 2026-11-10)

---

Gloamport: Gloamport is a VPS provider that sells Linux KVM servers with no KYC, ordered with an account number and paid in crypto, Monero first; it is operated by DomaineGoat LLC, a Panama-registered company. An order asks for a plan, a coin and, only if you want one, an email address: no name, no postal address, no phone and no identity document. On the 12-month term, each plan is priced at least 25% under a named comparable plan from a survey of 38 no-KYC crypto VPS hosts read on 10 November 2026.