Connect to your server with SSH
SSH (Secure Shell) is the standard way to manage a Linux server remotely. It opens an encrypted connection to the server so you can type commands as if you were sitting at it. This guide is for anyone with a VPS or cloud server. It covers connecting from Windows, macOS and Linux, setting up SSH keys and fixing the most common errors.
Connect for the first time
Windows 10 and 11, macOS and Linux all include the OpenSSH client, so you don't need to install anything. Open PowerShell or Windows Terminal on Windows, or Terminal on macOS and Linux, and run:
ssh jane@203.0.113.25
If the server uses a different port, add -p and the port number:
ssh -p 2222 jane@203.0.113.25
The host key prompt
The first time you connect to a server, SSH shows a message like this:
The authenticity of host '203.0.113.25 (203.0.113.25)' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])?
The fingerprint is a short code that identifies the server's own key. Your computer has not seen it before, so it asks you to confirm. If your provider shows the server's fingerprint, compare the two. Type yes to continue. SSH saves the key in your known_hosts file and checks it on every later connection.
If SSH later warns that the remote host identification has changed, stop and find out why before connecting. It is expected after you reinstall the server, but it can also mean you are not reaching the server you think you are. Once you are sure the change is legitimate, remove the old entry with ssh-keygen -R 203.0.113.25 and connect again.
Use SSH keys instead of passwords
An SSH key pair is two linked files: a private key that stays on your computer, and a public key that you place on the server. The server lets you in only if you hold the matching private key. Keys are much harder to guess or steal than passwords.
Create a key
ssh-keygen -t ed25519 -C "jane laptop"
-t ed25519 chooses a modern, compact key type, and -C adds a label so you can tell keys apart later. Press Enter to accept the default location, then set a passphrase. The passphrase protects the private key if your computer is lost or stolen.
This creates two files in the .ssh folder in your home folder: id_ed25519 (private) and id_ed25519.pub (public).
Never share, email or upload your private key, the file without .pub. Only the .pub file goes on servers.
Copy the public key to the server
On macOS and Linux, ssh-copy-id does it in one step, using your password one last time:
ssh-copy-id jane@203.0.113.25
Windows does not include ssh-copy-id. Instead, display your public key in PowerShell with Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub, copy the single line it shows, then connect to the server and add it:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "ssh-ed25519 AAAA...your-key... jane laptop" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
authorized_keys lists the public keys allowed to sign in as that user. Your provider may also let you add a public key when you create the server.
Open a new terminal and connect again. If it asks for your key's passphrase instead of the server password, the key works.
Save time with an SSH config file
The file ~/.ssh/config stores connection details under a short name. On Windows it lives at C:\Users\<you>\.ssh\config. Create it with a text editor:
Host myserver
HostName 203.0.113.25
User jane
Port 22
IdentityFile ~/.ssh/id_ed25519
Now ssh myserver connects with all those settings. File transfer apps that support SFTP can usually use the same key.
Common errors
| Error | What it usually means | What to check |
|---|---|---|
Connection refused | The server was reached, but nothing accepts SSH on that port | The SSH service is running, and you are using the right port |
Connection timed out | No answer at all | The IP address, that the server is running, and that a firewall allows the SSH port, including your provider's network firewall |
Permission denied (publickey) | The server only accepts keys and did not accept yours | The username, that your public key is in that user's authorized_keys, file permissions (700 for ~/.ssh, 600 for authorized_keys), and that you are offering the right key with -i or your config file |
Permission denied, please try again | Wrong password, or password sign-in is turned off for that user | The username and password, and whether the server allows password sign-in |
Host key verification failed | The saved fingerprint does not match the server's key | See the warning about changed host keys above |
To see what SSH is doing step by step, add -v to the command, for example ssh -v jane@203.0.113.25.
If you have locked yourself out, many providers offer a browser-based console that works without SSH. Use it to fix the configuration.
For full details of every option, see the OpenSSH documentation.