Skip to main content
An SSH key pair replaces the password when you connect to an instance. The private half stays on your machine and never leaves it; the public half goes on the server. Keys registered in the console can be installed on an instance when you create or reinstall it, so a new server is reachable without a password from the first boot.
Prerequisites
  • An OnetSolutions account with a project
  • An SSH key pair on your machine, or the commands below to create one

​
Generating a Key Pair

If you do not already have one, generate it locally. Ed25519 is the current recommendation — shorter than RSA and faster, with no loss of security.
Accept the default path, and set a passphrase when prompted. The passphrase protects the private key if your machine is lost — it does not have to be typed on every connection if you use an agent. This writes two files: Display the public half to copy it:
The output is a single line beginning with ssh-ed25519 and ending with the comment you passed. Copy the whole line.
Only ever paste the file ending in .pub. A private key starts with -----BEGIN OPENSSH PRIVATE KEY-----; if you see that, you have the wrong file. A private key that leaves your machine must be considered compromised and replaced.

​
Adding a Key to the Console

1

Open SSH Keys

In the console, go to Compute and open the SSH Keys tab.
2

Start adding a key

Click Add SSH Key.
3

Name the key

Fill in Key Name with something identifying the machine it belongs to, such as my-laptop. This name is only a label for you.
4

Paste the public key

Paste the full contents of your .pub file into Public Key.
5

Save

Confirm. The key appears in the list with its fingerprint, type, and the date it was added.
SSH keys belong to a project. A key added to one project is not available in another — add it again where you need it.

​
Using a Key on an Instance

A registered key can be selected when you create an instance or when you reinstall one. The key is installed for the default administrative account, and you can connect immediately:
If your key is not at the default path, point to it explicitly:
Adding a key to the console does not install it on instances that already exist. For a running instance, append the public key to ~/.ssh/authorized_keys on the server, or select the key when you reinstall.
To add a key to a running server yourself:

​
Removing a Key

Deleting a key from the console removes it from the list used for new instances and reinstalls. It does not remove it from servers where it was already installed — for that, edit ~/.ssh/authorized_keys on each instance concerned.

​
Troubleshooting

The server has no matching public key. Confirm the key was selected when the instance was created, and that you are connecting as the right user. Add -v to the ssh command to see which keys your client actually offered.
The pasted content is not a valid public key. It must be one line starting with ssh-ed25519, ssh-rsa, or a similar type. Line breaks introduced by a text editor are a common cause.
SSH refuses a private key readable by others. Fix it with chmod 600 ~/.ssh/id_ed25519 and chmod 700 ~/.ssh.
That is the agent’s job. Run ssh-add ~/.ssh/id_ed25519 once per session; on macOS, ssh-add --apple-use-keychain makes it persist.
It cannot be recovered — that is the point of it. Generate a new pair, add the new public key, and install it through a KVM console session or a reinstall.
Once key access works, disable password authentication on the server. It removes brute-force attempts against SSH entirely, which is most of the noise in a server’s auth log.