A fresh server with port 22 open starts getting probed within the hour. It is not personal — it is the background noise of the internet, and the only question is how lucky your password is.
Why a key is stronger
A password is something that can be guessed. A 256-bit key cannot be: brute-forcing it would take longer than the universe has existed. The private half also never leaves your machine, so there is nothing to intercept in transit.
Setup
Generate the pair on your own machine, not on the server:
ssh-keygen -t ed25519 -C "work laptop"
ed25519 is shorter and faster than RSA at equivalent strength. Then copy the public half across:
ssh-copy-id root@your-ip
Close the password door
While passwords still work, the key protects nothing — brute force simply goes around it. In /etc/ssh/sshd_config:
PasswordAuthentication no
PermitRootLogin prohibit-password
Then systemctl restart sshd.
Test the login in a new terminal window without closing the current one. If something is broken you still have a working session to undo it. Otherwise rescue mode is your only way back.
If you lose the key
Boot into rescue from the panel, mount the disk and append a new key to ~/.ssh/authorized_keys. Your data is untouched — rescue runs as a separate in-memory system.