SSH keys

An SSH key lets you sign in to a Linux server without typing a password. The panel keeps a library of your public keys and installs them into servers as they are built.

The library belongs to your account, not to one server. You reach it through a server's sidebar, but every key you add is offered on every server you build.

Generating a key pair

A key pair is two files. The public half ends in .pub and is what you paste into the panel. The private half never leaves your machine and is what proves who you are.

macOS and Linux

ssh-keygen -t ed25519 -C "you@your-laptop"

Press Enter to accept the default path, ~/.ssh/id_ed25519. Set a passphrase if you want the private key encrypted on disk. Then read the public half:

cat ~/.ssh/id_ed25519.pub

On macOS you can copy it straight to the clipboard:

pbcopy < ~/.ssh/id_ed25519.pub

Windows

Windows 10 and 11 ship OpenSSH, so the same command works in PowerShell:

ssh-keygen -t ed25519 -C "you@your-pc"

The default path is C:\Users\<you>\.ssh\id_ed25519. Copy the public half:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard

Which part to paste

Paste the contents of the .pub file. It is a single line that starts with the key type, then a long base64 block, then usually a comment:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... you@your-laptop

Never paste the file without the .pub extension. That is the private key, and it should never leave your machine.

The format the panel accepts

The public key must start with one of these, followed by a space:

Anything else is rejected with "Doesn't look like a valid SSH public key. It should start with ssh-rsa, ssh-ed25519, or ecdsa-sha2-*."

Adding a key

1. Open the dialog

   On the SSH Keys tab, select Add key. The dialog is titled Add SSH key and states that the key will be installed into any freshly built server tied to your account, and that existing servers are not affected.

2. Stay on Paste existing

   Two chips sit at the top, Paste existing and Generate new. Leave it on Paste existing if you made the key on your own machine.

3. Fill in Name and Public key

   Name is required and holds up to 64 characters. Use something that tells you which machine the private key lives on, for example work-laptop. Paste the .pub line into Public key. If the pasted line ends in a comment, the panel fills Name from it automatically.

4. Save

   Select Add key. The key appears as a card showing its name, its type, a truncated preview, and the date it was added.

There is no edit control. To change a key, delete it and add the new one.

Letting the panel generate the pair

If you would rather not use a terminal, switch the dialog to Generate new, choose a Key type from ED25519, RSA 2048, RSA 4096, or ECDSA P-256, and select Generate keypair.

The private key is then shown once, under the heading Private key (one-time view), with Copy and Download buttons. The panel does not store it. Save it before you close the dialog, then select Save & add key to add the public half to your library.

The download is a PEM file, which ssh accepts directly. On macOS and Linux, tighten its permissions before using it:

chmod 600 ~/Downloads/work-laptop.pem
ssh -i ~/Downloads/work-laptop.pem root@203.0.113.10

Getting a key onto a new server

Adding a key to the library does not queue it for anything on its own. When you build or rebuild a server, the form has an SSH keys section listing every key in your library, and only the keys you tick there are written into /root/.ssh/authorized_keys on the new install. A key you added but did not tick will not be on the server.

See Reinstalling your server for the rest of that form, including what a rebuild destroys.

Deleting a key

Select the trash icon on the key's card. The dialog is titled Remove SSH key? and the confirm button is Remove key.

Removing a key here stops it being offered on future builds. It does not touch any server that already has it. The dialog says so directly: the key will no longer be installed into future server builds, existing servers that already have it are not affected, and you must log in and remove it from ~/.ssh/authorized_keys manually to revoke it everywhere.

Changing keys on a server that already exists

Do this over SSH if you can still sign in, or from the console if you cannot.

To add a key to a running Linux server:

mkdir -p /root/.ssh
chmod 700 /root/.ssh
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... you@your-laptop" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

Add the key to the panel library as well, so your next rebuild can offer it.

To revoke a key, open the file and delete the whole line that carries it:

nano /root/.ssh/authorized_keys

Do this on every server that has the key. Nothing in the panel does it for you. If a key was compromised, also change the root password, which is covered on Resetting the root password.

Related