Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Yes. A single Linux user can use multiple SSH keys at the same time. To add a second key, generate a new key pair on your computer, append only its public-key line to the VPS user’s ~/.ssh/authorized_keys file, and leave the existing line untouched. The private key stays on the computer that generated it.
Keep your current SSH session open until you have successfully connected with the new key. That one precaution prevents a permissions or username mistake from locking you out.
How multiple SSH keys work
SSH public-key authentication uses two related files. The private key proves your identity and must remain on the client computer. The public key can be copied to servers. When you connect, the SSH server checks the public-key lines in the target account’s ~/.ssh/authorized_keys file. If one line matches the private key offered by your client, authentication succeeds.
Each line in authorized_keys represents an allowed public key. Adding a second line expands the account’s allowed keys; it does not overwrite the first key. This lets you keep separate credentials for a laptop, desktop, automation host, or another administrator while using the same Linux account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Ubuntu Server documentation recommends Ed25519 keys because they use shorter keys and require fewer computational resources than older algorithms. The commands below use Ed25519 and work with a typical Linux VPS running OpenSSH.
Choose the installation method
Use the method that matches the access you still have. Do not close a working session before testing the new credential.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems| Method | Required access | Where the public key is added | Explicit key path | Best use |
|---|---|---|---|---|
ssh-copy-id |
Password login must still work | Automatically appended to the remote user’s file | Yes, with -i |
Fastest password-assisted setup |
| Pipe and append | An existing SSH session or another working login | Appended by a remote shell command | Yes, in the local cat command |
Adding a key without enabling password authentication |
| Manual edit | An existing shell with permission to edit the target account | You open and edit ~/.ssh/authorized_keys |
Yes, when selecting the local public-key file | When you need to inspect the file while editing |
| Provider recovery console | Web or serial console administrator access | Added locally on the VPS | Not applicable on the console | No SSH login works |
In every case, install the public half only. Uploading a private key to the VPS defeats the separation that makes key authentication useful and exposes anyone who can read that server to the credential.
1. Generate a separate key pair on your computer
Run this command on the client computer from which you will connect:
ssh-keygen -t ed25519 -f ~/.ssh/vps_second_ed25519The -t ed25519 option selects the Ed25519 algorithm. The -f option gives this pair a distinct filename, so it does not replace an existing default key such as ~/.ssh/id_ed25519.
When prompted, enter a strong passphrase. A passphrase encrypts the private-key file if somebody obtains a copy of it. You can use an SSH agent to avoid typing the passphrase for every connection, but do not leave the private key unprotected.
After the command completes, you should have:
~/.ssh/vps_second_ed25519— the private key. Keep it on this client and protect it.~/.ssh/vps_second_ed25519.pub— the public key. This is the file that can be installed on the VPS.
Do not paste the contents of the private file into a ticket, chat message, cloud note, or server. If you accidentally disclose it, remove the corresponding public-key line from every server where it was authorized and generate a replacement pair.
2. Install the key with ssh-copy-id
If the VPS still accepts the account’s password, ssh-copy-id is usually the simplest option:
ssh-copy-id -i ~/.ssh/vps_second_ed25519.pub user@vps.exampleReplace user with the Linux account that should accept the key and replace vps.example with the VPS hostname or address. If the server listens on a nonstandard SSH port, include it with -p:
ssh-copy-id -p 2222 -i ~/.ssh/vps_second_ed25519.pub user@vps.exampleThe -i option matters when you have several local keys. It tells the utility exactly which public-key file to append instead of relying on its default identity selection. The utility logs in, creates the remote ~/.ssh directory and authorized_keys file when necessary, and appends the selected public key.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Enter the VPS account password when prompted. A successful run normally reports that one key was installed or that the key is already present. It does not need to remove the old line.
3. Append the key during an existing SSH session
This method is useful when password authentication is disabled but your current SSH connection still works. Leave that connection open. On your local computer, run:
cat ~/.ssh/vps_second_ed25519.pub | ssh user@vps.example
'umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys'The local cat reads the public-key file, while the SSH command sends its contents to the remote shell. On the VPS, umask 077 sets restrictive default permissions for files and directories created by the command, mkdir -p ensures the directory exists, and >> appends rather than truncates the authorization file.
If the server uses another port, put the port option before the host:
cat ~/.ssh/vps_second_ed25519.pub | ssh -p 2222 user@vps.example
'umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys'The command authenticates using whatever key your client normally selects for that connection. To force the currently working key, add its private-key path with -i, for example:
cat ~/.ssh/vps_second_ed25519.pub | ssh -i ~/.ssh/current_working_key user@vps.example
'umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys'Because the command appends the complete line, do not wrap the key, insert line breaks, or add quotation marks around the key text.
4. Add the line manually on the VPS
If you are already logged in and prefer to inspect the file, display the public key locally:
cat ~/.ssh/vps_second_ed25519.pubCopy the entire single line, including its key type, encoded key data, and optional comment. On the VPS, open the target account’s file with an editor:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →nano ~/.ssh/authorized_keysMove to the end, create a new line, paste the public key, save, and exit. Do not delete or modify the existing key line. A public key normally begins with ssh-ed25519 and must remain one uninterrupted line.
If you are logged in as an administrator and adding a key for a different account, use that account’s home directory, not the administrator’s. For example, editing /root/.ssh/authorized_keys authorizes root, while editing /home/user/.ssh/authorized_keys authorizes user. The ownership and permissions must belong to the intended account.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Use the provider recovery console when SSH is unavailable
If no SSH key or password can log in, open the VPS provider’s web, virtual-console, or serial-console feature. Sign in as an administrator, then append the public key to the intended user’s authorization file from that console.
First identify the account and home directory, then create or edit its files. For an account named user, the target is commonly:
/home/user/.ssh/authorized_keysFor a root login, the target is commonly:
/root/.ssh/authorized_keysAfter adding the line, correct ownership and permissions if necessary. A recovery console is also a fallback for resetting an account password so that ssh-copy-id can be used later. Console names and authentication steps vary by VPS provider, so follow that provider’s access procedure while keeping the file and key rules the same.
6. Set permissions and ownership correctly
OpenSSH may reject a key when the .ssh directory or authorized_keys file is writable by other users. From the target account’s shell, a commonly accepted restrictive setup is:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keysUbuntu documentation also gives chmod go-w .ssh/authorized_keys as a corrective check to remove group and other write permissions. Use the account’s own home directory when running these commands.
If an administrator created the files for another user, fix ownership as well. For example, as root:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutechown -R user:user /home/user/.sshReplace both instances of user with the actual account name. A wrong owner, an incorrect home directory, or a mounted filesystem with unexpected permissions can produce the same “key refused” symptom even when the public-key text is correct.
7. Test the new key before closing the old session
From the client that holds the new private key, force SSH to use it:
ssh -i ~/.ssh/vps_second_ed25519 user@vps.exampleFor a nonstandard port, add -p:
ssh -p 2222 -i ~/.ssh/vps_second_ed25519 user@vps.exampleConfirm that the login reaches the expected account and host. Check the remote identity with:
whoami
hostnameOnly after this test succeeds should you close the original session. If the new login fails, keep the original connection available for corrections.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
8. Select the second key automatically with SSH config
Typing -i each time works, but an SSH client configuration entry makes the choice repeatable. Edit or create ~/.ssh/config on your local computer:
Host my-vps-second-key
HostName vps.example
User user
IdentityFile ~/.ssh/vps_second_ed25519
IdentitiesOnly yesConnect with the alias:
ssh my-vps-second-keyIdentityFile points to the private key. IdentitiesOnly yes tells the client to use the configured identity instead of offering a collection of agent keys that could cause the server to reject the connection after too many attempts. If your VPS uses another port, add an indented Port 2222 line.
Protect the local configuration and private key as you would any credential. The public key may be copied to the VPS; the private key and its passphrase should remain under your control.
Plan key names and access deliberately
Use a different key pair for each device or person rather than copying one private key among several users. A descriptive filename such as vps_second_ed25519 makes it clear which credential is being tested. The optional comment at the end of a public-key line can identify the laptop or administrator, but it is only a label; changing it does not change the cryptographic key.
Before adding a line, confirm the exact Linux account, hostname, address, and SSH port. A key placed in one account’s file cannot authenticate as another account. Likewise, installing a key on one VPS does not authorize it on a different VPS unless you add its public line there too.
Keep a simple inventory of where each public key is installed. When a laptop is lost, an employee leaves, or an automation host is retired, delete only that key’s complete line from each affected authorized_keys file. Do not remove the other administrator’s line merely because it appears nearby. After editing, test a still-authorized key from a separate session.
Common mistakes that cause lockouts
- Running
ssh-keygenwithout-fand accidentally overwriting or replacing the key you already use. - Copying the private file instead of the matching
.pubfile. - Using
>instead of>>, which truncatesauthorized_keysand removes existing access. - Editing the administrator’s file while intending to authorize an ordinary user.
- Testing with an SSH agent that offers a different key first; use
-iand, when appropriate,IdentitiesOnly yes. - Closing the only working session before confirming the new login, port, username, and remote hostname.
- Making
.sshorauthorized_keysbroadly writable to silence an error. Correct ownership and restrictive modes instead.
Troubleshoot a rejected second key
The wrong username is being tested
Keys belong to the account whose authorized_keys file contains them. A key installed for user will not automatically authorize admin or root. Recheck the username in both the installation command and the test command.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The wrong local key is being offered
Use the explicit private-key path:
ssh -vvv -i ~/.ssh/vps_second_ed25519 user@vps.exampleVerbose output shows which identities the client offers and whether the server accepts one. If the output never mentions the intended key, check the path, filename, and local file permissions.
The public-key line was damaged
Compare the VPS line with the output of:
cat ~/.ssh/vps_second_ed25519.pubThe key type and encoded data must match exactly. Keep the line on one physical line. A missing character, accidental wrapping, or copying the private file instead of the .pub file prevents authentication.
The server is listening on another port
Use the VPS’s configured SSH port in both installation and testing. A connection to the wrong port may reach another service or fail before key authentication begins.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Permissions or ownership are too open or incorrect
From the target account, inspect the directory and file, then apply the restrictive permissions shown earlier. If an administrator created them, verify that the target account owns both paths. Do not make the files broadly writable as a workaround.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRead the live SSH service log
On a system using the ssh.service unit, watch the server log while attempting a connection:
sudo journalctl -fu ssh.serviceThe log can distinguish an unknown user, an unreadable authorization file, a rejected key, or a server-side policy issue. Stop the log with Ctrl+C after the failed test.
Safe key-management practices
- Give each device or person a separate key pair instead of sharing one private key.
- Keep an existing working session open while changing authorization.
- Use descriptive filenames and SSH config aliases so you can identify the intended key.
- Install only public keys on servers and protect private keys with passphrases.
- When a device is lost or a user no longer needs access, remove only that key’s line from
authorized_keys; leave unrelated keys intact. - Keep a tested recovery-console path for the VPS in case every SSH credential is unavailable.
The essential operation is simple: generate a second pair locally, append its .pub line to the correct user’s authorized_keys, and verify a connection with the matching private key. Existing keys continue to work until you deliberately remove their lines.
Frequently Asked Questions
Can two SSH keys work for the same Linux user?
Yes. Each public-key line in that user’s ~/.ssh/authorized_keys is an accepted credential. Add the second line without deleting the first.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Do I upload the private key to the VPS?
No. Install only the .pub file. Keep the private key and its passphrase on the client that will use it.
What is the easiest way to add the key?
When password login still works, run ssh-copy-id -i ~/.ssh/vps_second_ed25519.pub user@vps.example. The utility appends the selected public key and can create the remote SSH directory and file.
How can I add a key when password authentication is disabled?
Keep an existing SSH session open and use the pipe-and-append command, or edit the target user’s authorized_keys manually from that session.
What if no SSH login works?
Use the VPS provider’s web, virtual, or serial recovery console with administrator access, then add the public key to the intended user’s home directory.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why does the new key still get rejected?
Check the username, hostname, port, exact public-key line, file ownership, and restrictive permissions. Then run ssh -vvv -i with the new private key and watch sudo journalctl -fu ssh.service on the server.
How do I ensure SSH uses the second key every time?
Create a host entry in ~/.ssh/config with IdentityFile and IdentitiesOnly yes, then connect through its alias.
How do I remove only the old key later?
Delete that key’s complete line from the appropriate user’s authorized_keys file, leaving all unrelated lines intact. Keep another tested login available while editing.
The Bottom Line
Generate the second Ed25519 pair on your client, append only its public line to the correct user’s authorized_keys, set ownership and restrictive permissions, and test with the matching private key before closing your current session. Multiple keys coexist safely until you intentionally remove one.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
