SSH keys

An SSH key lets you connect to your server without typing a password, and far more securely than a password would allow. You add it once in the console and it is injected into every server you create.

A key is a pair of files: the private key (stays on your computer, never shared) and the public key (the .pub file you add to the console).

Creating a key

On Windows, use PowerShell rather than Command Prompt

Windows 10 and later ship with the SSH tools, but some commands (such as reading a file) only work in PowerShell. Type PowerShell in the Start menu to open it.

Run:

ssh-keygen -t ed25519 -C "hepcloud"

The command asks three questions. You can simply press Enter at all three:

"Enter file in which to save the key"

Where to store the key. Type nothing and press Enter — the default shown in brackets is the right one:

Windows: C:\Users\<your-user>\.ssh\id_ed25519
macOS / Linux: ~/.ssh/id_ed25519

If you type a name here

The file is saved into your current folder under that name, and SSH will not find it automatically. If you already did this, see I saved it in the wrong place below.

"Enter passphrase"

An extra password protecting the key itself. You may leave it empty and press Enter — most people do, and you are then never asked for it when connecting.

If you share your computer with others, setting one is safer: even a stolen key file is then useless.

"Enter same passphrase again"

Confirms the previous answer. If you left it empty, press Enter again.

When you see Your public key has been saved in ... and The key fingerprint is SHA256:..., your key is ready.

Printing the public key

The content you paste into the console lives in the .pub file.

Windows (PowerShell)

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

macOS and Linux

cat ~/.ssh/id_ed25519.pub

cat does not work on Windows

cat is a macOS/Linux command. In Windows PowerShell the equivalent is Get-Content; in the old Command Prompt it is type.

The single line starts with ssh-ed25519 AAAA... and ends with the label you passed (hepcloud). Copy the whole line.

Adding it to the console

Go to SSH Keys → Add key, give the key a name and paste the line. The fingerprint is shown in the console; the same key cannot be added twice.

I saved it in the wrong place

If you typed a name at the first question (for example hepcloud), the files went into whatever folder you were in — SSH does not look there.

Easiest fix: run the command again and press Enter at the first question. A new key is created in the default location; you can delete the old files.

If you would rather move them (PowerShell):

New-Item -ItemType Directory -Force $env:USERPROFILE\.ssh
Move-Item hepcloud $env:USERPROFILE\.ssh\id_ed25519
Move-Item hepcloud.pub $env:USERPROFILE\.ssh\id_ed25519.pub

Using it when creating a server

Select your key on the server creation page. Selected keys are written to the server during setup, and you connect as root without a password:

ssh root@<server-ip>

You can select several keys — giving every team member their own key is the cleanest approach, because you can tell who connected.

If your key is not in the default location

Tell SSH which file to use: ssh -i C:\path\to\key root@<server-ip>

If you do not select a key

A root password is generated and shown once in the console. Save it before closing that screen; it is not shown again.

Removing a key

Deleting a key does not revoke access

Deleting a key in the console does not remove it from servers that were already created — it still works there. To cut off access, connect to the server and remove the line from ~/.ssh/authorized_keys.