Manage SSH keys

SSH key authentication provides a more secure alternative to password login for Linux virtual servers. An SSH key pair consists of a private key stored locally and a public key deployed on the server. The server grants access only to connections that present the matching private key.

Set up SSH key authentication

1. Generate a key pair

   On the local machine (Linux, macOS, or Windows with OpenSSH), open a terminal and run:

   ssh-keygen -t ed25519 -C "my-key"
   

   Press Enter to accept the default file path, or enter a custom path. The command creates two files:

   • ~/.ssh/id_ed25519 — the private key. Keep this file secure; do not share it with anyone.
   • ~/.ssh/id_ed25519.pub — the public key. This is the file to copy to the server.

   The server username and IP address — needed in the next step — are available on the Instructions tab in the Hosting portal.

2. Copy the public key to the server

   Run ssh-copy-id from the local machine while password access is still available:

   ssh-copy-id -i ~/.ssh/id_ed25519.pub username@server_ip
   

   Replace username with the account name (typically root) and server_ip with the server’s IP address.

   If ssh-copy-id is unavailable (Windows systems without OpenSSH 8.1 or later), append the public key manually. Log in to the server with a password, then run:

   echo "public_key_content" >> ~/.ssh/authorized_keys
   chmod 600 ~/.ssh/authorized_keys
   

   Replace public_key_content with the full contents of the id_ed25519.pub file (a single long line starting with ssh-ed25519).

Connect with an SSH key

With the public key on the server, connect using the private key:

ssh -i ~/.ssh/id_ed25519 username@server_ip

If the key is stored in the default location (~/.ssh/id_ed25519), the -i flag can be omitted — the SSH client uses it automatically.

Remove a public key

Open ~/.ssh/authorized_keys on the server and delete the line containing the key to revoke:

nano ~/.ssh/authorized_keys

Each line in the file represents one authorized key. Delete the line for the key to remove, then save the file. The removed key loses access on the next connection attempt.