How to Secure SSH with Ed25519 Keys and 2FA on Linux Cloud VPS

The Inadequacy of Standard Passwords

Every Linux cloud server exposed to the public Internet is subjected to continuous automated dictionary attacks. Weak passwords can be cracked in seconds using distributed GPU clusters. Transitioning to Ed25519 elliptic curve keys paired with Time-Based One-Time Password (TOTP) 2FA creates an impenetrable two-tier authentication challenge.

Step 1: Generating Ed25519 Cryptographic Keys

On your local development machine, generate an Ed25519 keypair:

ssh-keygen -t ed25519 -a 100 -C "admin@production-vps"

Always protect the private key with a strong local passphrase.

Step 2: Copying Key to Cloud VPS

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@YOUR_VPS_IP

Step 3: Installing Google Authenticator PAM Module

Log in to your cloud VPS and install the Pluggable Authentication Module (PAM):

sudo apt update
sudo apt install -y libpam-google-authenticator

Run the initialization wizard under your administrative user:

google-authenticator

1. Do you want authentication tokens to be time-based? Type y.
2. Scan the displayed terminal QR code using Google Authenticator, Authy, or 1Password.
3. Record the 5 emergency scratch codes in your secure password vault.
4. Update .google_authenticator file? Type y.
5. Disallow multiple uses of the same token? Type y.

Step 4: Configuring PAM and SSH Daemon for 2FA

Open /etc/pam.d/sshd:

sudo nano /etc/pam.d/sshd

Add this line at the bottom:

auth required pam_google_authenticator.so nullok

Now configure /etc/ssh/sshd_config.d/2fa.conf:

sudo nano /etc/ssh/sshd_config.d/2fa.conf

KbdInteractiveAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
PermitRootLogin no
PasswordAuthentication no

Test syntax and restart SSH:

sudo sshd -t
sudo systemctl restart ssh

Validation & Recovery Procedure

Keep your current SSH session open! In a separate terminal window, test logging in. The server will authenticate your Ed25519 key first, then prompt for your 6-digit TOTP code before granting shell access. If you lose your phone, log in through the Contabo Customer Control Panel VNC console using root credentials to reset your user's ~/.google_authenticator file.