Using SSH Keys

An SSH key is a pair of files. The private key stays on your computer. The public key (.pub) goes on the server. The server lets in anyone who holds a private key that matches one of its public keys, without a password.

To install a key on new servers, add it to your workspace in the panel. Read more in SSH Keys.

Creating a key

ssh-keygen -t ed25519 -C "my-laptop"

Press Enter to save it in the default location. We recommend a passphrase. Anyone who copies the private key file also needs the passphrase to use the key.

This creates id_ed25519 (private, never share it) and id_ed25519.pub (public) in the .ssh folder of your computer’s user folder. For a key on a YubiKey or another security key, see Hardware Security Keys.

Adding a key to a server by hand

From Linux or macOS:

ssh-copy-id root@203.0.113.10

From Windows PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@203.0.113.10 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Both append your public key to ~/.ssh/authorized_keys on the server. If SSH still asks for a password, fix the permissions on the server:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Warning

The “Sync SSH Keys” operation replaces root’s authorized_keys with your full workspace keys list. Keys you added to root by hand are removed. Add the key to your workspace instead to keep it.

Using ssh-agent

ssh-agent holds your unlocked keys so you type the passphrase once per session.

On Linux:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

On macOS, store the passphrase in your Keychain:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

On Windows, start the agent service once from an administrator PowerShell, then add the key from a regular one:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

Saving connection details

Add an entry to ~/.ssh/config (.ssh\config in your user folder on Windows) to connect with a short name:

Host my-server
    HostName 203.0.113.10
    User root
    IdentityFile ~/.ssh/id_ed25519

Then connect with ssh my-server.