---
title: "Create and place an SSH key on a cloud server"
sidebar_label: "Create and place an SSH key"
sidebar_position: 2
description: "How to create an SSH key pair, place a public SSH key on a cloud server, and how SSH keys work for a project and service user"
---

import {CustomTable} from 'docs-kit/components'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from 'docs-kit/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Create and place an SSH key on a cloud server

SSH keys can be used for secure [server connection](/cloud-servers/manage/connect-to-server.mdx) via the encrypted SSH protocol. This is a key pair: the private key remains on your local computer, while the public key is placed on the server.

For authorization on a cloud server, we recommend using SSH keys instead of a login and password.

You can use SSH keys of the types ed25519, rsa, ecdsa, and dsa. Learn more about [SSH keys for users](#ssh-keys-for-user).

1. [Create an SSH key pair](#create-ssh-keys).

2. Optional: [add a public SSH key to the user profile](#add-public-ssh-key-to-profile).

3. [Place a public SSH key on a cloud server](#place-public-ssh-key).

## 1. Create an SSH key pair \{#create-ssh-keys}

You can create SSH keys in two ways:

* [via the OS](#create-ssh-keys-in-os);
* using [OpenStack CLI](#create-ssh-keys-via-openstack).

### Create an SSH key pair via the OS \{#create-ssh-keys-in-os}

<Tabs queryString="create-ssh-keys-in-os">
  <TabItem value="unix" default>
    <TabItemLabel>
      Linux/macOS
    </TabItemLabel>

    1. Open the CLI.

    2. Generate an SSH key pair:

       ```bash
       ssh-keygen -t <key_type>
       ```

       Specify `<key_type>` — the SSH key type: `еd25519`, `rsa`, `ecdsa` or `dsa`

    3. A message will appear asking you to choose a directory to store the key pair—example for an RSA key:

       ```bash
       Enter file in which to save the key (~/.ssh/id_rsa):
       ```

       To keep the default directory for storing keys, press **Enter**. If you want to select a different directory, enter it in the format `/path/to/id_rsa` and press **Enter**.

    4. Optional: enter a passphrase for additional security, repeat it, and press **Enter**:

       ```bash
       Enter passphrase (empty for no passphrase):
       Enter same passphrase again:
       ```

    5. Wait for the message stating that the keys have been generated. Two files will be created: `id_rsa` (private key) and `id_rsa.pub` (public key). The key fingerprint and its image will appear in the terminal:

       ```bash
       Your identification has been saved in ~/.ssh/id_rsa
       Your public key has been saved in ~/.ssh/id_rsa.pub
       The key fingerprint is:
       The key's randomart image is:
       ```

    6. Display the public SSH key:

       ```bash
       cat <path>
       ```

       Specify `<path>` — the full path to the public key you specified in step 3, for example `~/.ssh/id_rsa.pub`.
  </TabItem>

  <TabItem value="windows">
    <TabItemLabel>
      Windows
    </TabItemLabel>

    1. Install [PuTTY](https://putty.org.ru/).

    2. Open the PuTTYgen application.

    3. In the **Parameters** → **Type of key to generate** field, select the RSA key type.

    4. Click **Generate**.

    5. Move your cursor in the PuTTYgen window until the key pair is created.

    6. After the keys are created, click **Save public key** and **Save private key**.

    7. Specify the path to store the keys.

    8. Optional: in the **Key passphrase** field, enter a passphrase for additional security.

    9. Copy the public SSH key.
  </TabItem>
</Tabs>

### Create an SSH key pair via OpenStack CLI \{#create-ssh-keys-via-openstack}

The SSH key will only be available for the one service user, project, and pool for which you have [configured authorization in the OpenStack API](/cloud-servers/tools/openstack-cli/configure-openstack-cli.mdx#configure-openstack-in-os).

When generating SSH keys via OpenStack CLI, the public key is automatically added to the user profile.

1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

2. Generate an SSH key pair:

   ```bash
   openstack keypair create <key_name> --private-key <file_for_key>
   ```

   Specify:

   * `<key_name>` — key name;
   * `<file_for_key>` — the file where the private SSH key will be saved on the local computer.

## 2. Optional: add a public SSH key to the user profile \{#add-public-ssh-key-to-profile}

You can add a public SSH key to your profile or to another user's profile. Then you can [place the key on the server](#place-public-ssh-key) during server creation or on an existing server.

The key will be available in all projects the user is added to.

If you generated the SSH key pair via OpenStack CLI, the public key was automatically added to your profile.

<Tabs queryString="add-public-ssh-key-to-profile">
  <TabItem value="own-profile" default>
    <TabItemLabel>
      To your profile
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/profile/access/ssh-keys) in the upper-right corner, open the menu (account number) and select **Profile**.

    2. Go to the **Access** section.

    3. Open the **SSH keys** tab.

    4. Click **Add key**.

    5. Enter the key name.

    6. Paste the public SSH key in OpenSSH format.

    7. Click **Add**.
  </TabItem>

  <TabItem value="other-user">
    <TabItemLabel>
      To another user's profile
    </TabItemLabel>

    Use the [Add SSH key](/access-control/manage/edit-user-data-or-role.mdx#add-ssh-key) subsection of the Changing User Data or Permissions guide. Only the [Account Owner](/access-control/user-types.mdx#account-owner) and a user with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin) role can add keys for other users.

    The key will be available in all projects the user is added to.
  </TabItem>
</Tabs>

## 3. Place a public SSH key on a cloud server \{#place-public-ssh-key}

A public SSH key can be placed when [creating a cloud server](/cloud-servers/create/create-server.mdx) or on an existing server.

To access the cloud server via SSH, add the public SSH key to the `~/.ssh/authorized_keys` file on the server. You can add multiple keys, for example, if you need access for several users.

Public SSH keys can be placed on an existing server using a utility or manually.

<Tabs queryString="place-public-ssh-key">
  <TabItem value="ssh-copy-id-command">
    <TabItemLabel>
      Via a utility
    </TabItemLabel>

    The utility adds the public SSH key to the end of the `~/.ssh/authorized_keys` file. The command used creates the directory and file if they do not already exist.

    <Tabs queryString="place-ssh-key-via-utility">
      <TabItem value="unix" default>
        <TabItemLabel>
          From Linux/macOS
        </TabItemLabel>

        1. Open the CLI on your local computer.

        2. Copy the public SSH key to the cloud server:

           ```bash
           ssh-copy-id -i <path> <username>@<ip_address>
           ```

           Specify:

           * `<path>` — the full path to the public key on the local computer, for example `~/.ssh/id_rsa.pub`;
           * `<username>` — user name;
           * `<ip_address>` — the server's public IP address.

        3. Enter the user password.
      </TabItem>

      <TabItem value="windows">
        <TabItemLabel>
          From Windows
        </TabItemLabel>

        1. Open the CLI on your local computer.

        2. Copy the public SSH key to the cloud server:

           ```bash
           scp <local_path> <username>@<ip_address>:<server_path>
           ```

           Specify:

           * `<local_path>` — full path to the public key on the local computer;
           * `<username>` — user name;
           * `<ip_address>` — public IP address of the server;
           * `<server_path>` — the path for storing the public key on the server, for example `C:\Users\username\.ssh\authorized_keys`.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="manually">
    <TabItemLabel>
      Manually
    </TabItemLabel>

    1. Open the file containing the public SSH key on your local computer:

       <Tabs queryString="open-ssh-manually">
         <TabItem value="unix" default>
           <TabItemLabel>
             Linux/macOS
           </TabItemLabel>

           ```bash
           cat <path>
           ```

           Specify `<path>` — the full path to the public key on the local computer, for example `~/.ssh/id_rsa.pub`.
         </TabItem>

         <TabItem value="windows">
           <TabItemLabel>
             Windows
           </TabItemLabel>

           ```bash
           type <path>
           ```

           Specify `<path>` — the full path to the public key on the local computer, for example `C:\Users\username\.ssh\id_rsa.pub`.
         </TabItem>
       </Tabs>

    2. Copy the value of the public SSH key.

    3. [Connect to the server](/cloud-servers/manage/connect-to-server.mdx).

    4. Go to the `.ssh:` directory:

       ```bash
       cd .ssh
       ```

    5. Create the `authorized_keys:` file:

       ```bash
       touch authorized_keys
       ```

    6. Add the public SSH key to the `authorized_keys` file:

       ```bash
       echo <public_ssh_key> >> ~/.ssh/authorized_keys
       ```

       Specify `<public_ssh_key>` — the public SSH key that you copied in step 2. It starts with `ssh-rsa`.

    7. Configure access rights:

       ```bash
       chmod 700 ~/.ssh
       chmod 600 ~/.ssh/authorized_keys``
       ```
  </TabItem>
</Tabs>

## SSH keys for users \{#ssh-keys-for-user}

<CustomTable>
  <table data-sticky>
    <tbody>
      <tr>
        <th>How to [add a key to a user profile](#add-public-ssh-key-to-profile)</th>

        <td>
          <ul>
            <li>For yourself: in the control panel in the upper-right corner, open the menu (account number) → **Profile** → the **Access** section → the **SSH keys** tab; </li><li>for another user: in the control panel in the top menu, click **IAM** → the **Users** or **Service Users** section → user page; </li><li>added automatically when [creating SSH keys](#create-ssh-keys) via OpenStack CLI (the `openstack keypair create` command);</li><li>via API;</li><li>via Terraform;</li><li>via selvpc CLI</li>
          </ul>
        </td>
      </tr>

      <tr>
        <th>How to place it on a cloud server when [creating a server](/cloud-servers/create/create-server.mdx)</th>

        <td>
          <ul>
            <li>Via OpenStack CLI (the `openstack server create` command);</li><li>via API;</li><li>via Terraform</li>
          </ul>
        </td>
      </tr>

      <tr>
        <th>Available for which users</th><td>For one user of any type</td>
      </tr>

      <tr>
        <th>Available in which projects</th><td>In all projects the user is added to</td>
      </tr>

      <tr>
        <th>Available in which pools</th>

        <td>
          <ul>
            <li>Available in all pools if added in the control panel in the **Account** → **Users** section → tab with the required user type → user page;</li><li>available only in pools in which it was added via OpenStack CLI, API, Terraform, selvpc CLI</li>
          </ul>
        </td>
      </tr>

      <tr>
        <th>Where to view the key list</th>

        <td>
          <ul>
            <li>Your own: in the control panel in the upper-right corner, open the menu (account number) → **Profile** → the **Access** section → the **SSH keys tab**;</li><li>other users: in the control panel, click **IAM** in the top menu → **Users** or **Service Users** → user page;</li><li>via OpenStack CLI (the `openstack keypair list` command);</li><li>via API;</li><li>via Terraform;</li><li>via selvpc CLI</li>
          </ul>
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />