Use SSH Keys Instead of Password Authentication; Cpanel Security

SSH key authentication is dramatically more secure than passwords. Here’s why it matters and how to set it up on your cPanel server.

The Problem With Password-Based SSH

Password authentication over SSH is vulnerable to brute-force attacks, credential stuffing, and phishing. No matter how strong a password is, it remains a single string of characters that can theoretically be guessed, intercepted, or leaked.

Why SSH Keys Are Stronger

SSH key pairs use cryptographic authentication instead of a memorized secret. The private key never leaves your local machine, and the public key installed on the server can’t be used to derive the private key. This makes brute-forcing SSH key authentication effectively infeasible with current technology.

How to Set Up SSH Key Authentication

1. On your local machine, generate a key pair: ssh-keygen -t ed25519 -C "your-email@example.com".
2. Copy the public key to your server, either through WHM’s SSH Access > Manage SSH Keys feature or the ssh-copy-id command.
3. In WHM, navigate to SSH Access > Manage SSH Keys, import or generate the key, and authorize it for the intended account.
4. Test logging in using the key before disabling password authentication.
5. Once confirmed working, edit /etc/ssh/sshd_config and set PasswordAuthentication no, then restart SSH.

Best Practices

• Protect your private key with a strong passphrase.
• Use a different key pair for each administrator rather than sharing one key.
• Revoke and rotate keys immediately for any departing team member or contractor.

Switching to SSH key authentication removes an entire category of password-guessing attacks and is one of the most impactful changes you can make to server-level security.