Create and host an SSH key on a cloud server

Last update: October 29 2024

Create and host an SSH key on a cloud server

SSH keys can be used to securely server connections over the encrypted SSH protocol. This is a key pair: the private key is stored on the local computer and the public key is placed on the server.

We recommend using SSH keys instead of login and password to authenticate to the cloud server.

SSH keys of types ed25519, rsa, ecdsa, and dsa can be used.

1. Create an SSH key pair.

2. Optional: Add a public SSH key to the cloud platform.

   The way a key is added to the cloud platform affects its availability in projects, pools, and to users, as well as the way it is placed on the server when created. See the table for more details on key differences SSH keys for project and service user.

3. Place a public SSH key on a cloud server.

Create SSH keys⁠

Linux/macOS

1. Open the CLI.

2. Generate a pair of SSH keys:

   ssh-keygen -t <key_type>

   Specify <key_type> — SSH key type: еd25519, rsa, ecdsa or dsa

3. A message will appear asking you to select a directory to store the key pair — example for rsa key:

   Enter file in which to save the key (~/.ssh/id_rsa):

   To leave the default directory for storing keys, click Enter. If you want to select a different directory, enter it in the format /path/to/id_rsa and press Enter.

4. Optional: enter a passphrase for additional protection, repeat the passphrase and press Enter:

   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:

5. Wait for the message that the keys have been generated. Two files will be created: id_rsa (private key) and id_rsa.pub (public key). The key fingerprint and its image will appear in the terminal:

   Your identification has been saved in ~/.ssh/id_rsa
   Your public key has been saved in ~/.ssh/id_rsa.pub
   The key fingerprint is:
   The key's randomart image is:

6. Output the public SSH key:

   cat <path>

   Specify <path> — the full path to the public key you specified in step 3, for example ~/.ssh/id_rsa.pub.

Windows

1. Set PuTTY.
2. Open the PuTTYgen application.
3. In the field Parameters → Type of key to generate select the RSA key type.
4. Click Generate.
5. Move the cursor in the PuTTYgen window until a key pair is created.
6. After creating the keys, click Save public key и Save private key.
7. Specify a path to store the keys.
8. Optional: in the field Key passphrase enter a passphrase for additional protection.
9. Copy the public SSH key.

OpenStack CLI

When generating SSH keys through the OpenStack CLI, the public key will automatically be added to the cloud platform.

The SSH key will only be available for the single service user, project, and pool for which you configured authorization in OpenStack API.

Read more about SSH keys for the service user.

1. Open the OpenStack CLI.

2. Generate a pair of SSH keys:

   openstack keypair create <key_name> --private-key <file_for_key>

   Specify:

   • <key_name> — key name;
   • <file_for_key> — file that will store the private SSH key on the local computer.

optional: add a public SSH key to the cloud platform⁠

A public SSH key can be added to a cloud-based platform and then hosted at the server creation.

The way a key is added to the cloud platform affects its availability in projects, pools, and to users, as well as the way it is placed on the server when created. See the table for more details on key differences SSH keys for project and service user.

For the project

The key will only be available in one project, for all users.

1. В control panels go to Cloud platform → Access.
2. Open the tab SSH keys.
3. Click Add an SSH key.
4. Enter the name of the key.
5. Insert a public SSH key in OpenSSH format.
6. Click Add key.

For the service user

The key will be available in all projects to which a service user with the Project administrator or Project viewer roles has been added.

1. В control panels go to Access control → User management.
2. Open the tab Service users.
3. Open the user page.
4. In the field SSH keys click Add key.
5. Enter the name of the key.
6. Insert a public SSH key in OpenSSH format.
7. Click Add.

Host a public SSH key on a cloud server⁠

You can place a public SSH key by cloud server creation or on an existing server.

To access the cloud server via SSH, you need to add a public SSH key to the file ~/.ssh/authorized_keys on the server. You can add multiple keys, for example, if you need access for multiple users.

You can place public SSH keys on an existing server in two ways:

• copy the key to the server from the local computer using the ssh-copy-id command;
• manually place the key on the server.

Copy a public SSH key from a local computer using ssh-copy-id⁠

From Linux/macOS

Team ssh-copy-id adds the public SSH key to the end of the file ~/.ssh/authorized_keys. The command creates a directory and a file if they have not already been created.

1. Open the CLI on the local computer.

2. Copy the public SSH key to the cloud server:

   ssh-copy-id -i <path> <username>@<ip_address>

   Specify:

   • <path> — the full path to the public key on the local computer, e.g. ~/.ssh/id_rsa.pub;
   • <username> — username;
   • <ip_address> — the public IP address of the server.

3. Enter the user's password.

From Windows

1. Open cmd on the local computer.

2. Copy the public SSH key to the cloud server:

   scp <local_path> <username>@<ip_address>:<server_path>

   Specify:

   • <local_path> — the full path to the public key on the local computer;
   • <username> — username;
   • <ip_address> — the public IP address of the server;
   • <server_path> — path for storing the public key on the server, e.g. C:\Users\username\.ssh\authorized_keys.

Manually place a public SSH key on the server⁠

1. Open the public SSH key file on the local computer:

   Linux/macOS

   cat <path>

   Specify <path> — the full path to the public key on the local computer, e.g. ~/.ssh/id_rsa.pub.

   Windows

   type <path>

   Specify <path> — the full path to the public key on the local computer, e.g. C:\Users\username\.ssh\id_rsa.pub.

2. Copy the value of the public SSH key.

3. Connect to the server.

4. Go to the directory .ssh:

   cd .ssh

5. Create a file authorized_keys:

   touch authorized_keys

6. Add to the file authorized_keys public SSH key:

   echo <public_ssh_key> >> ~/.ssh/authorized_keys

   Specify <public_ssh_key> — public SSH key that you copied in step 2. It starts with ssh-rsa.

7. Configure access rights:

   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys

SSH keys for project and service user⁠

A public SSH key can be added to the cloud platform:

• for projects;
• or for service user с role Project Administrator or Project Supervisor.

	SSH key for the project	SSH key for the service user
How add a key to the cloud platform	In the control panel, under Cloud platform → Access	In the control panel, under Access control → User management → tab Service users → user page; will be added automatically when creating SSH keys through the OpenStack CLI (command openstack keypair create); through the API; through Terraform; through the selvpc CLI
How to host on a cloud server when server creation	In the control panel	Through the OpenStack CLI (openstack server create command); through the API; through Terraform
For which users is it available	For all users of the project	For one service user with the roles Project Administrator or Project Supervisor
In which projects is it available	In one project.	In all projects to which a service user has been added
What pools are available in	Only in the pool to which it was added	Available in all pools if added in the control panel under Access control → User management → tab Service users → user page; is available only in pools to which it was added via OpenStack CLI, API, Terraform, selvpc CLI
Where can I see the list of keys	In the control panel, under Cloud platform → Access	In the control panel, under Access control → User management → tab Service users → user page; through the OpenStack CLI (command openstack keypair list); through the API; through Terraform; through the selvpc CLI