DigitalOcean SSH to Droplet: The Complete Setup & Connection Guide (2025)

You’ve created your first DigitalOcean Droplet. It’s running. The IP address is sitting in your Control Panel. Now what?

The answer — almost always — is SSH.

SSH (Secure Shell) is the backbone of remote server management. It’s how developers, system administrators, and DevOps engineers securely connect to cloud servers from anywhere in the world — running commands, deploying applications, editing configuration files, managing databases, and doing everything that keeps web infrastructure alive and functional.

If you’re setting up a DigitalOcean Droplet for the first time, or you’re troubleshooting a broken SSH connection on an existing one, this is the guide you need. We cover every method, every platform (Mac, Windows, Linux), SSH key setup from scratch, security hardening, file transfers, the Droplet Console, and troubleshooting for every common error.

1. What Is SSH and Why Does It Matter?

SSH (Secure Shell) is a network protocol that creates an encrypted, authenticated communication channel between your local machine and a remote server. It is critical for system administrators, developers, and DevOps teams to remotely access virtual machines like DigitalOcean Droplets, automate tasks with scripts, and even forward ports or tunnel traffic through secure connections for added protection and control.

When you connect to a DigitalOcean Droplet via SSH, you get a full terminal interface on the remote server — every command you type runs directly on the Droplet. You can:

Install and configure software
Deploy web applications
Edit server configuration files
Manage databases and user accounts
Monitor system resources and logs
Transfer files between your local machine and the server
Run scripts and automate tasks

How SSH Authentication Works

SSH supports two authentication methods:

Password authentication — you enter a username and password. Simple to set up, but vulnerable to brute-force attacks. DigitalOcean strongly recommends against relying on password authentication for production servers.

SSH key authentication — uses an asymmetric cryptographic key pair. Your local machine holds the private key (never shared). The Droplet holds the corresponding public key. When you connect, the server uses the public key to verify your identity without transmitting any password over the network. SSH keys are more secure than passwords and can help you log in without having to remember long passwords.

The private key remains on your local machine, while the public key is placed on the remote server. When connecting, the server uses the public key to verify your identity without transmitting passwords — making key-based authentication both more secure and more convenient than password authentication.

Understanding server management is foundational to building a reliable web presence. Our website development services team manages DigitalOcean infrastructure — including SSH access, security hardening, and server configuration — as part of every managed hosting engagement.

2. Prerequisites Before You Connect

You need three pieces of information before you can SSH into a Droplet:

Requirement	Where to Find It
Droplet’s IP address	DigitalOcean Control Panel → Droplets → your Droplet’s IP is displayed
Username	Default is `root` on Ubuntu, CentOS, Debian; some Marketplace images use different defaults
Authentication	Your SSH private key file (recommended) or the password set during Droplet creation

Finding Your Droplet’s IP Address

Log in to cloud.digitalocean.com
Click Droplets in the left sidebar
Your Droplet’s IPv4 address is displayed directly in the list view next to the Droplet name

Default Usernames by Operating System

OS	Default SSH Username
Ubuntu	`root`
Debian	`root`
CentOS	`root`
Fedora	`root`
CoreOS	`core`
FreeBSD	`freebsd`
RancherOS	`rancher`

After initial login, it’s best practice to create a non-root user with sudo privileges and use that for ongoing access.

3. Step 1: Generate an SSH Key Pair

Before connecting to your Droplet with key-based authentication, you need to generate an SSH key pair on your local machine. This applies to Mac, Linux, and Windows (using PowerShell or WSL).

Generate SSH Keys on macOS and Linux

Open your terminal and run:

ssh-keygen -t ed25519 -C "your_email@example.com"

Breaking down the command:

-t ed25519 — specifies the Ed25519 algorithm, which is the modern recommended choice (more secure and faster than older RSA)
-C "your_email@example.com" — adds a comment label to identify the key (optional but helpful)

If your system doesn’t support Ed25519, use RSA:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Step-by-step through the prompts:

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/username/.ssh/id_ed25519):

Press Enter to accept the default location (~/.ssh/id_ed25519). Or specify a custom path for multiple keys.

Enter passphrase (empty for no passphrase):

Enter a strong passphrase — this encrypts your private key on disk, so even if someone steals the key file, they can’t use it without the passphrase. Press Enter twice (once to set, once to confirm).

Your identification has been saved in /home/username/.ssh/id_ed25519
Your public key has been saved in /home/username/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx your_email@example.com

Two files are created:

~/.ssh/id_ed25519 — your private key (never share this, never upload it anywhere)
~/.ssh/id_ed25519.pub — your public key (safe to share; this goes on the Droplet)

View Your Public Key

cat ~/.ssh/id_ed25519.pub

The output looks like:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx your_email@example.com

Copy this entire output — you’ll need it in the next step.

Generate SSH Keys on Windows (PowerShell)

Windows 10 version 1809 and later, and Windows 11, include OpenSSH by default. Open PowerShell and run:

ssh-keygen -t ed25519 -C "your_email@example.com"

The prompts and process are identical to macOS/Linux. Your keys are saved in C:\Users\YourUsername\.ssh\.

View your public key in PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub

4. Step 2: Add Your SSH Key to DigitalOcean

Method A: Add During Droplet Creation (Recommended)

The cleanest approach is to add your SSH key to DigitalOcean before creating the Droplet — then select it during creation, and your Droplet will be pre-configured with your public key from the first boot.

Go to Settings → Security in your DigitalOcean Control Panel (or navigate to cloud.digitalocean.com/account/security)
Click “Add SSH Key”
Paste your public key into the “SSH key content” field (the full output of cat ~/.ssh/id_ed25519.pub)
Give it a descriptive name (e.g., “MacBook Pro – Work”, “Home Desktop”)
Click “Add SSH Key”

When creating a new Droplet, scroll to the “Authentication” section and select your saved SSH key. The Droplet will be created with this key automatically installed.

Method B: Add to an Existing Droplet via `ssh-copy-id`

If you have an existing Droplet with password authentication enabled:

ssh-copy-id username@YOUR_DROPLET_IP

For example:

ssh-copy-id root@203.0.113.0

This command:

Connects to the Droplet (prompting for your password)
Automatically appends your public key to ~/.ssh/authorized_keys on the Droplet
Sets correct file permissions on the server

After running ssh-copy-id, you can connect without a password. To specify a particular key file:

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR_DROPLET_IP

Method C: Manually Add to `authorized_keys`

If ssh-copy-id isn’t available or you need to do it manually:

Connect to your Droplet (via password SSH or the Droplet Console)
Create the .ssh directory if it doesn’t exist:

mkdir -p ~/.ssh
chmod 700 ~/.ssh

Add your public key to the authorized keys file:

echo "YOUR_PUBLIC_KEY_CONTENT" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Replace YOUR_PUBLIC_KEY_CONTENT with the full output of your .pub file. The chmod commands set the required restrictive permissions — SSH will refuse to use the key if the permissions are too open.

Important: After adding the key manually, verify you can connect with key authentication before closing your existing session. Never close your only terminal access until you’ve confirmed the new key works.

5. Step 3: Connect to Your Droplet via SSH

Basic SSH Connection (macOS and Linux)

Open your terminal and enter:

ssh root@YOUR_DROPLET_IP

For example:

ssh root@203.0.113.0

On first connection, you’ll see a host verification prompt:

The authenticity of host '203.0.113.0 (203.0.113.0)' can't be established.
ECDSA key fingerprint is SHA256:IcLk6dLi+0yTOB6d7x1GMgExamplewZ2BuMn5/I5Jvo.
Are you sure you want to continue connecting (yes/no)?

Type yes and press Enter. This saves the server’s fingerprint to ~/.ssh/known_hosts on your local machine, so future connections skip this prompt.

Warning: Permanently added '203.0.113.0' (ECDSA) to the list of known hosts.

If you’re using SSH keys, you’ll connect immediately (or after entering your key passphrase if you set one). If using password authentication, enter your Droplet’s root password when prompted.

Successful connection changes your terminal prompt to something like:

root@your-droplet-name:~#

You’re now connected and can run any command on the Droplet.

Connecting as a Non-Root User

After creating a non-root user on your Droplet:

ssh username@YOUR_DROPLET_IP

Connecting with a Specific SSH Key

If you have multiple SSH keys and need to specify which one to use:

ssh -i ~/.ssh/id_ed25519 root@YOUR_DROPLET_IP

The -i flag specifies the identity file (private key) to use for authentication.

Connecting on a Custom Port

If you’ve changed SSH from the default port 22 to a custom port (a security recommendation covered in Section 12):

ssh -p 2222 root@YOUR_DROPLET_IP

The -p flag specifies the port number.

Combining Options

ssh -i ~/.ssh/id_ed25519 -p 2222 username@YOUR_DROPLET_IP

6. How to SSH from Windows (PuTTY & PowerShell)

Windows users have several options for SSH access to DigitalOcean Droplets:

Option A: PowerShell (Windows 10/11 — Recommended)

Modern Windows includes OpenSSH natively. Open PowerShell (or Command Prompt) and use the exact same syntax as macOS/Linux:

ssh root@YOUR_DROPLET_IP

PowerShell’s SSH client is fully compatible with all the commands in Section 5. This is the recommended approach for Windows 10 (version 1809+) and Windows 11 users.

Check if OpenSSH is installed:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

Install if not present:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

Option B: PuTTY (For Older Windows or GUI Preference)

PuTTY is a free, widely used SSH client for Windows that provides a graphical interface. Download it from putty.org.

Connecting with PuTTY:

Open PuTTY
In the “Host Name (or IP address)” field, enter your Droplet’s IP address
Ensure Port is set to 22 and Connection type is SSH
Click “Open”
The first connection shows a security alert about the host key — click “Accept”
In the terminal that opens, enter root as the username
Enter your password when prompted (or see below for key-based auth)

Using SSH Keys with PuTTY:

PuTTY uses its own key format (.ppk) rather than the standard OpenSSH format. To use your existing SSH keys with PuTTY:

Open PuTTYgen (installed alongside PuTTY)
Click “Load” → browse to your id_ed25519 or id_rsa private key file
Click “Save private key” → save as a .ppk file
In PuTTY’s main window: Connection → SSH → Auth → Browse → select your .ppk file
Return to Session and connect as normal — PuTTY will authenticate with the key instead of a password

Option C: Windows Subsystem for Linux (WSL)

If you have WSL installed, open your Linux distribution’s terminal and use the standard Linux SSH commands — they work identically to macOS/Linux.

Option D: Git Bash

Git for Windows includes Git Bash, which provides an SSH client. Open Git Bash and use standard SSH commands as you would on Linux.

7. Using the DigitalOcean Droplet Console (Browser-Based)

The Droplet Console is a browser-based way to connect to Droplets. Instead of using SSH in a local terminal, you can use the Droplet Console in your preferred web browser.

It provides one-click SSH access to your Droplet without the need for a password or manual SSH key configuration — and it works even if you can’t access your Droplet via standard SSH (for example, if you’ve accidentally locked yourself out or misconfigured a firewall).

Droplet Console vs Recovery Console

	Droplet Console	Recovery Console
Connection type	SSH over network	VNC (direct hardware-level access)
Requires network	Yes	No
Works if SSH is down	No	Yes
Works if network is down	No	Yes
Interface quality	Native-like terminal	Basic, slower
Best for	Convenient browser access	Emergency recovery

The Droplet Console connects to Droplets using the network, like other SSH-based clients, and has features similar to local terminals. The Recovery Console is like plugging a keyboard and monitor directly into the Droplet.

Step-by-Step: Access the Droplet Console

Log in to cloud.digitalocean.com
Click Droplets → click the name of your Droplet
Click the “Access” tab in the left menu
In the “Droplet Console” section, enter the username to log in as (default: root)
Click “Launch Droplet Console”
A browser terminal window opens — you are now connected

The console provides a full command-line interface. Run commands exactly as you would in an SSH terminal.

When to Use the Droplet Console

Locked out of SSH — if you accidentally blocked port 22 in a firewall rule
Troubleshooting sshd — if the SSH daemon crashed or is misconfigured
First-time setup without SSH keys configured yet
Quick access without SSH client — when working from a machine without your SSH keys

Limitations of the Droplet Console

Requires a working network connection to DigitalOcean’s infrastructure
Copy-paste behavior varies by browser (Ctrl+Shift+V for paste in most browsers)
Does not support file transfer operations
Slightly slower than native SSH due to the browser layer

8. SSH via doctl (DigitalOcean CLI)

doctl is DigitalOcean’s official command-line interface. It provides a convenient way to SSH into Droplets directly from the terminal without manually looking up IP addresses — particularly useful when managing multiple Droplets.

Install doctl

macOS:

brew install doctl

Linux:

wget https://github.com/digitalocean/doctl/releases/download/v1.101.0/doctl-1.101.0-linux-amd64.tar.gz
tar xf doctl-1.101.0-linux-amd64.tar.gz
sudo mv doctl /usr/local/bin

Windows: Download the installer from doctl’s GitHub releases.

Authenticate doctl

doctl auth init

When prompted, enter your DigitalOcean Personal Access Token (generate one at cloud.digitalocean.com → API → Personal Access Tokens → Generate New Token).

SSH into a Droplet Using doctl

Basic usage:

doctl compute ssh YOUR_DROPLET_NAME

Or using the Droplet ID:

doctl compute ssh YOUR_DROPLET_ID

List your Droplets to find names/IDs:

doctl compute droplet list

This shows all your Droplets with their names, IDs, IP addresses, and status.

doctl SSH with custom options:

# SSH as a specific user
doctl compute ssh your-droplet --ssh-user username

# SSH on a custom port
doctl compute ssh your-droplet --ssh-port 2222

# SSH with a specific private key
doctl compute ssh your-droplet --ssh-key-path ~/.ssh/custom_key

The advantage of doctl compute ssh over manual SSH is that doctl automatically resolves the Droplet name to its current IP address — so if you ever resize a Droplet and its IP changes, doctl compute ssh still works without updating anything.

9. Adding SSH Keys to an Existing Droplet

For security reasons, you can’t add or modify the SSH keys on your Droplet using the control panel after you create it, but you have several options to add and modify them via the command line.

Method 1: ssh-copy-id (Easiest — Requires Current Access)

If you have existing SSH or password access:

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR_DROPLET_IP

This copies your public key to the Droplet automatically.

Method 2: Manual Append via SSH

Connect to your Droplet first, then append the key:

# On your LOCAL machine, get your public key
cat ~/.ssh/id_ed25519.pub
# Copy the output

# SSH into the Droplet
ssh root@YOUR_DROPLET_IP

# On the DROPLET, append the key
echo "PASTE_YOUR_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys

# Verify the file contents
cat ~/.ssh/authorized_keys

Method 3: Pipe the Key in One Command

cat ~/.ssh/id_ed25519.pub | ssh root@YOUR_DROPLET_IP "cat >> ~/.ssh/authorized_keys"

This pipes your local public key directly into the remote authorized_keys file in one command — no manual copy-paste required.

Adding a Key for a Non-Root User

# On the Droplet, logged in as root
adduser newuser                    # Create the user
usermod -aG sudo newuser           # Add to sudo group
mkdir /home/newuser/.ssh           # Create .ssh directory
chmod 700 /home/newuser/.ssh       # Set correct permissions
chown newuser:newuser /home/newuser/.ssh

# Add the public key
echo "PUBLIC_KEY_CONTENT" > /home/newuser/.ssh/authorized_keys
chmod 600 /home/newuser/.ssh/authorized_keys
chown newuser:newuser /home/newuser/.ssh/authorized_keys

Removing an Old SSH Key

To remove a specific key (useful when a device is lost or stolen):

# On the Droplet, open authorized_keys
nano ~/.ssh/authorized_keys

# Find and delete the line containing the key you want to remove
# Save and exit

10. Transferring Files via SSH (SCP & SFTP)

SSH isn’t just for terminal access — it also enables secure file transfer via scp (Secure Copy) and SFTP (SSH File Transfer Protocol).

SCP: Copy Files via the Command Line

Upload a file from local to Droplet:

scp /local/path/to/file.txt root@YOUR_DROPLET_IP:/remote/path/

Download a file from Droplet to local:

scp root@YOUR_DROPLET_IP:/remote/path/file.txt /local/destination/

Upload an entire directory (recursive):

scp -r /local/directory/ root@YOUR_DROPLET_IP:/remote/path/

SCP with a specific key or port:

scp -i ~/.ssh/id_ed25519 -P 2222 file.txt root@YOUR_DROPLET_IP:/path/

Note: SCP uses -P (capital P) for port, unlike SSH which uses -p.

SFTP: Interactive File Transfer Session

SFTP provides an interactive session for browsing and transferring files:

sftp root@YOUR_DROPLET_IP

Common SFTP commands:

ls              # List files on the remote Droplet
lls             # List files on your local machine
pwd             # Print remote working directory
lpwd            # Print local working directory
cd /path        # Change directory on Droplet
lcd /path       # Change directory locally
get file.txt    # Download file from Droplet
put file.txt    # Upload file to Droplet
get -r dir/     # Download directory recursively
put -r dir/     # Upload directory recursively
exit            # Close SFTP session

GUI File Transfer Clients (Recommended for Non-Technical Users)

For those who prefer a graphical interface over command-line file transfer:

FileZilla (Windows/Mac/Linux — Free)

Go to File → Site Manager → New Site
Set Protocol to SFTP – SSH File Transfer Protocol
Host: Your Droplet’s IP address
Port: 22 (or your custom SSH port)
Logon Type: Key file
User: root
Key file: Browse to your private key file
Click Connect

Cyberduck (Mac/Windows — Free)

Open a new connection → select SFTP (SSH File Transfer Protocol)
Server: Your Droplet’s IP
Username: root
SSH Private Key: select your key file

11. SSH Config File: Simplify Your Connections

Typing ssh root@203.0.113.0 -i ~/.ssh/specific_key -p 2222 every time you connect is tedious. The SSH config file (~/.ssh/config) allows you to create named shortcuts for all your SSH connections.

Create or Edit the SSH Config File

nano ~/.ssh/config

Set restrictive permissions on the file:

chmod 600 ~/.ssh/config

Basic Config Entry

Host my-droplet
    HostName 203.0.113.0
    User root
    IdentityFile ~/.ssh/id_ed25519
    Port 22

With this entry, instead of:

ssh -i ~/.ssh/id_ed25519 root@203.0.113.0

You simply type:

ssh my-droplet

Multiple Droplets in Config

# Production web server
Host prod-web
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/prod_key
    Port 22

# Staging server
Host staging
    HostName 203.0.113.20
    User root
    IdentityFile ~/.ssh/id_ed25519
    Port 2222

# Database server (internal, accessed via jump host)
Host db-server
    HostName 10.0.0.5
    User dbadmin
    ProxyJump prod-web
    IdentityFile ~/.ssh/id_ed25519

# Default settings for all DigitalOcean servers
Host *.digitalocean.com
    User root
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60

Useful Config Options

Option	Description
`Host`	The alias you’ll type in the SSH command
`HostName`	The actual IP address or domain
`User`	Username to log in as
`IdentityFile`	Path to your private key
`Port`	SSH port (default 22)
`ServerAliveInterval 60`	Sends keep-alive packets every 60 seconds (prevents timeout)
`ServerAliveCountMax 3`	Disconnects after 3 failed keep-alives
`ProxyJump`	Connect through a jump host (bastion server)
`ForwardAgent yes`	Forward SSH agent for key chaining
`StrictHostKeyChecking no`	Skip host fingerprint verification (use carefully)

SCP and SFTP also use your SSH config automatically — scp my-droplet:/path/file.txt . works with the config entry above.

12. Securing Your SSH Connection

A freshly created DigitalOcean Droplet with root SSH access exposed on port 22 to the internet will receive automated brute-force attempts within minutes of creation. These hardening steps significantly reduce attack surface.

1. Disable Root Login

Create a non-root user first, then disable root SSH access:

# Create a new user
adduser yourusername
usermod -aG sudo yourusername

# Add your SSH key to the new user (see Section 9)
# Then verify you can log in as the new user before proceeding

# Disable root login
sudo nano /etc/ssh/sshd_config

Find and change:

PermitRootLogin yes

To:

PermitRootLogin no

2. Disable Password Authentication

Once SSH key authentication is working, disable password login entirely:

In /etc/ssh/sshd_config, find and set:

PasswordAuthentication no
ChallengeResponseAuthentication no

Restart SSH to apply changes:

sudo systemctl restart sshd

Warning: Verify key-based authentication works before disabling password auth. Test in a new terminal window before closing your existing session.

3. Change the Default SSH Port

Attackers often target the default port, so changing it can deter them. Change port 22 to a higher number:

sudo nano /etc/ssh/sshd_config

Find:

Port 22

Change to your chosen port (e.g., 2222, 49152, etc.):

Port 2222

Restart sshd:

sudo systemctl restart sshd

Important: Update your DigitalOcean Cloud Firewall (or UFW) to allow the new port before restarting SSH:

sudo ufw allow 2222/tcp
sudo ufw deny 22/tcp

Future connections use: ssh -p 2222 username@YOUR_DROPLET_IP

4. Install and Configure Fail2Ban

Fail2Ban is a useful tool to enhance SSH security. It automatically blocks IP addresses that show malicious behavior:

# Install Fail2Ban
sudo apt install fail2ban -y

# Create a local jail configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Find the [sshd] section and configure:

[sshd]
enabled = true
port    = ssh
filter  = sshd
maxretry = 3
bantime = 3600
findtime = 600

This bans any IP that fails SSH login 3 times within 10 minutes, for 1 hour.

# Start and enable Fail2Ban
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

# Check Fail2Ban status
sudo fail2ban-client status sshd

5. Configure a DigitalOcean Cloud Firewall

The most effective first line of defense is restricting SSH access to known IP addresses at the DigitalOcean level — before traffic even reaches your Droplet:

Go to Networking → Firewalls in the DigitalOcean Control Panel
Create a new Firewall
Under Inbound Rules, add a rule:
- Type: SSH
- Protocol: TCP
- Port: 22 (or your custom port)
- Sources: Your specific IP address (e.g., 203.0.113.100/32)
Apply the Firewall to your Droplet

This allows SSH access only from your specified IP addresses, making brute-force attacks from other IPs impossible at the network level.

6. Keep SSH Updated

Regularly update the SSH server:

sudo apt update && sudo apt upgrade -y openssh-server

Summary: SSH Security Hardening Checklist

✅ Use SSH key authentication instead of passwords
✅ Disable password authentication
✅ Disable root SSH login
✅ Change the default SSH port from 22
✅ Install and configure Fail2Ban
✅ Restrict SSH access by IP in Cloud Firewall
✅ Keep OpenSSH updated

13. Troubleshooting SSH Connection Issues

❌ “Connection refused” Error

Symptom: ssh: connect to host 203.0.113.0 port 22: Connection refused

Causes and fixes:

SSH daemon isn’t running — use the Droplet Console to start it:
```
sudo systemctl start sshd
sudo systemctl status sshd
```
Firewall blocking port 22 — check your Cloud Firewall rules in the DigitalOcean Control Panel, and check UFW on the Droplet:
```
sudo ufw status
sudo ufw allow 22/tcp
```
Wrong port — if you’ve changed the SSH port, use -p YOUR_PORT:
```
ssh -p 2222 root@YOUR_DROPLET_IP
```
Droplet is powered off — check the Droplet status in the Control Panel and power it on if needed.

❌ “Permission denied (publickey)” Error

Symptom: Permission denied (publickey).

Causes and fixes:

Public key not in authorized_keys — add it using the methods in Section 9
Wrong private key — specify the correct key with -i:
```
ssh -i ~/.ssh/correct_key root@YOUR_DROPLET_IP
```

Incorrect file permissions — SSH refuses keys with overly permissive permissions:

# Fix private key permissionschmod 600 ~/.ssh/id_ed25519# Fix authorized_keys permissions on the serverchmod 700 ~/.sshchmod 600 ~/.ssh/authorized_keys

Wrong username — ensure you’re using the correct default username for the OS (see Section 2)

❌ “Host Key Verification Failed” Error

Symptom: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! Host key verification failed.

Cause: This happens when you recreate or replace a Droplet while keeping the same IP address. The server’s host key has changed, but your local known_hosts file still has the old key.

Fix:

ssh-keygen -R YOUR_DROPLET_IP

This removes the old entry for that IP from ~/.ssh/known_hosts. Reconnect and accept the new fingerprint.

❌ “Connection timed out” Error

Symptom: ssh: connect to host 203.0.113.0 port 22: Operation timed out

Causes and fixes:

Wrong IP address — double-check the IP in the DigitalOcean Control Panel
Cloud Firewall blocking you — verify your IP is allowed in the Cloud Firewall rules
Network issue — test connectivity with ping: ping YOUR_DROPLET_IP
Droplet is unresponsive — use the Droplet Console or try a Power Cycle

❌ SSH Connection Drops Frequently

Symptom: SSH sessions disconnect after a few minutes of inactivity.

Fix — on the client side, add to ~/.ssh/config:

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3

Fix — on the server side, add to /etc/ssh/sshd_config:

ClientAliveInterval 60
ClientAliveCountMax 3

Restart sshd: sudo systemctl restart sshd

❌ Slow SSH Login

Symptom: SSH takes 20–30 seconds to display the login prompt.

Common cause: DNS reverse lookup timeout. The SSH server tries to resolve your IP address to a hostname and times out.

Fix — in /etc/ssh/sshd_config:

UseDNS no

Restart sshd. This disables reverse DNS lookup and typically resolves the slow login immediately.

❌ “Bad Permissions” Warning

Symptom: WARNING: UNPROTECTED PRIVATE KEY FILE! Permissions 0644 for '/home/user/.ssh/id_ed25519' are too open. It is recommended that your private key files are NOT accessible by others.

Fix:

chmod 600 ~/.ssh/id_ed25519
chmod 700 ~/.ssh/

SSH requires strict permissions on key files and will refuse to use keys that are readable by other users.

14. Frequently Asked Questions

How do I SSH into a DigitalOcean Droplet? To SSH into a Droplet, use the command ssh root@YOUR_DROPLET_IP in your terminal (macOS, Linux, or Windows PowerShell). Replace YOUR_DROPLET_IP with your Droplet’s public IP address, visible in the DigitalOcean Control Panel. If you set up SSH key authentication, you’ll connect immediately or after entering your key passphrase. If using password authentication, enter your root password when prompted.

What is the default username for SSH on DigitalOcean? The default SSH username is root for most DigitalOcean operating systems including Ubuntu, CentOS, and Debian. Exceptions include CoreOS (core), FreeBSD (freebsd), and RancherOS (rancher). After initial setup, creating a non-root user with sudo privileges and using that for regular access is strongly recommended.

How do I generate an SSH key for DigitalOcean? On macOS or Linux, open a terminal and run ssh-keygen -t ed25519 -C "your_email@example.com". Press Enter to accept the default file location and enter a passphrase. This creates two files: ~/.ssh/id_ed25519 (private key — keep this secret) and ~/.ssh/id_ed25519.pub (public key — add this to DigitalOcean). On Windows, use PowerShell with the same command, or use PuTTYgen for the PuTTY SSH client.

Why is my SSH connection to DigitalOcean being refused? “Connection refused” typically means the SSH service isn’t running, the firewall is blocking port 22, or the Droplet is powered off. Use the DigitalOcean Droplet Console to access the server directly and check sudo systemctl status sshd. Also verify your Cloud Firewall rules allow inbound traffic on port 22 from your IP address.

Can I SSH into a DigitalOcean Droplet from Windows? Yes. Windows 10 (version 1809+) and Windows 11 include OpenSSH natively — open PowerShell and use ssh root@YOUR_DROPLET_IP exactly as you would on macOS or Linux. Alternatively, use PuTTY (a free graphical SSH client), Git Bash, or Windows Subsystem for Linux (WSL).

What is the DigitalOcean Droplet Console? The Droplet Console is a browser-based SSH terminal built into the DigitalOcean Control Panel. It provides one-click access to your Droplet’s command line without requiring a local SSH client or SSH key configuration. Access it via your Droplet’s detail page → Access tab → Launch Droplet Console. It’s particularly useful when SSH access is unavailable due to firewall misconfiguration or a locked-out account.

How do I add an SSH key to an existing DigitalOcean Droplet? Use ssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR_DROPLET_IP from your local terminal (requires existing password or key access). Alternatively, connect via the Droplet Console and manually append your public key to ~/.ssh/authorized_keys on the Droplet.

How do I make my DigitalOcean SSH connection more secure? Key security steps include: 1) Use SSH key authentication instead of passwords, 2) Disable password authentication in /etc/ssh/sshd_config, 3) Disable root login (PermitRootLogin no), 4) Change the default port from 22, 5) Install Fail2Ban to block brute-force attempts, 6) Restrict SSH access to specific IP addresses via DigitalOcean’s Cloud Firewall.

Wrapping Up

SSH is the gateway to everything you do on a DigitalOcean Droplet. Mastering it — from key generation and initial connection to security hardening, file transfers, and SSH config shortcuts — transforms server management from an intimidating technical hurdle into a fluid, efficient workflow.

Here’s the quick-reference summary:

Task	Command / Method
Generate SSH key	`ssh-keygen -t ed25519`
View public key	`cat ~/.ssh/id_ed25519.pub`
Copy key to Droplet	`ssh-copy-id root@IP`
Basic SSH connection	`ssh root@YOUR_DROPLET_IP`
SSH with specific key	`ssh -i ~/.ssh/key root@IP`
SSH on custom port	`ssh -p 2222 root@IP`
SSH via doctl	`doctl compute ssh droplet-name`
Upload file (SCP)	`scp file.txt root@IP:/path/`
Download file (SCP)	`scp root@IP:/path/file.txt .`
Fix “host key changed”	`ssh-keygen -R YOUR_DROPLET_IP`
Browser-based access	DigitalOcean Control Panel → Access → Launch Console

For businesses building on DigitalOcean infrastructure, solid SSH management is just the beginning. From server configuration and deployment automation to website performance and search visibility, Macroter’s team helps businesses build and grow their digital presence end to end:

🔍 Search Engine Optimization Services
✍️ SEO Content Writing Services
📣 Content Marketing Services
💰 Pay-Per-Click (PPC) Marketing Services
🌐 Website Development Services
📱 Social Media Management Services

Published by Macroter Digital Marketing Agency — Helping businesses grow through data-driven SEO, content, and digital strategy.

Md Nasir Uddin

I’m Md Nasir Uddin, a digital marketing consultant with over 9 years of experience helping businesses grow through strategic and data-driven marketing. As the founder of Macroter, my goal is to provide businesses with innovative solutions that lead to measurable results. Therefore, I’m passionate about staying ahead of industry trends and helping businesses thrive in the digital landscape. Let’s work together to take your marketing efforts to the next level.

1. What Is SSH and Why Does It Matter?

How SSH Authentication Works

2. Prerequisites Before You Connect

Finding Your Droplet’s IP Address

Default Usernames by Operating System

3. Step 1: Generate an SSH Key Pair

Generate SSH Keys on macOS and Linux

View Your Public Key

Generate SSH Keys on Windows (PowerShell)

4. Step 2: Add Your SSH Key to DigitalOcean

Method A: Add During Droplet Creation (Recommended)

Method B: Add to an Existing Droplet via ssh-copy-id

Method C: Manually Add to authorized_keys

5. Step 3: Connect to Your Droplet via SSH

Basic SSH Connection (macOS and Linux)

Connecting as a Non-Root User

Connecting with a Specific SSH Key

Connecting on a Custom Port

Combining Options

6. How to SSH from Windows (PuTTY & PowerShell)

Option A: PowerShell (Windows 10/11 — Recommended)

Option B: PuTTY (For Older Windows or GUI Preference)

Option C: Windows Subsystem for Linux (WSL)

Option D: Git Bash

7. Using the DigitalOcean Droplet Console (Browser-Based)

Droplet Console vs Recovery Console

Step-by-Step: Access the Droplet Console

When to Use the Droplet Console

Limitations of the Droplet Console

8. SSH via doctl (DigitalOcean CLI)

Install doctl

Authenticate doctl

SSH into a Droplet Using doctl

9. Adding SSH Keys to an Existing Droplet

Method 1: ssh-copy-id (Easiest — Requires Current Access)

Method 2: Manual Append via SSH

Method 3: Pipe the Key in One Command

Adding a Key for a Non-Root User

Removing an Old SSH Key

10. Transferring Files via SSH (SCP & SFTP)

SCP: Copy Files via the Command Line

SFTP: Interactive File Transfer Session

GUI File Transfer Clients (Recommended for Non-Technical Users)

11. SSH Config File: Simplify Your Connections

Create or Edit the SSH Config File

Basic Config Entry

Multiple Droplets in Config

Useful Config Options

12. Securing Your SSH Connection

1. Disable Root Login

2. Disable Password Authentication

3. Change the Default SSH Port

4. Install and Configure Fail2Ban

5. Configure a DigitalOcean Cloud Firewall

6. Keep SSH Updated

Summary: SSH Security Hardening Checklist

13. Troubleshooting SSH Connection Issues

❌ “Connection refused” Error

❌ “Permission denied (publickey)” Error

❌ “Host Key Verification Failed” Error

❌ “Connection timed out” Error

❌ SSH Connection Drops Frequently

❌ Slow SSH Login

❌ “Bad Permissions” Warning

14. Frequently Asked Questions

Wrapping Up

Leave a Comment Cancel reply

Macroter

Office Location

Resources

Method B: Add to an Existing Droplet via `ssh-copy-id`

Method C: Manually Add to `authorized_keys`