cPanel is letting me in via SFTP without a key

Question

I currently have a shared plan on asmallorange because I wanted to give them a try. I am trying to establish some security when it comes to file transfers.

Through cPanel, I created an SSH key. The name of it is id_rsa and it is currently "not authorized".

I then went into WinSCP. I set up an SFTP connection using the following info:

Host: (mydomain.com)
Port: 22
Username: (cPanel username)
Password: (cPanel password)

The problem is that it let me in. I didn't even have to enter any type of key information, it just let me into the server and I can see all the files.

Why is this happening and how do I set this up properly, so that this is secure?

Answer 1

This appears to be an asmallorange shared hosting issue in that they do not require a key for SFTP connections.

Answer 2

If you have an SSH password, then your connection doesn't need the SSH key. Username/Password is enough to connect.

SSH key authentication is a way of connecting to a server without having to use a password. If you only want to allow key-based login, you can try contacting your host and ask them disable password login over SSH(/SFTP).