How to create and use authentication keys for SSH connections to OVHcloud servers

Learn how to create and manage authentication key pairs on your local device and use them to connect to remote servers.

The SSH protocol enables a secure communication channel over public networks in a client-server architecture. Key pairs can be used to authenticate these SSH connections between two trusted hosts, for example a desktop client and a remote server.

A key set consists of a public key that can be shared and a private key that remains secret. Placed on a server, the public key allows any client that has the corresponding private key to connect to it without the need to enter a password.

This method is usually the best compromise between security and convenience.

Requirements

• A Dedicated Server or a VPS
• A remote connection client application compatible with the OpenSSH protocol

Topics

• Creating an SSH key pair
• Adding SSH keys to your server
• Managing multiple SSH keys on your local device
• Importing your SSH key into the OVHcloud Control Panel
• Adding a default rescue SHH key to your server

Instructions

Be sure to consult our "Getting Started" guides:

• For a dedicated server
• For a dedicated server of the Eco product line
• For a VPS

Creating key pairs for OpenSSH connections

The following instructions cover two methods of using SSH keys:

• Creating an OpenSSH key pair and connecting to a server from the command line SSH client
• Creating a PuTTY key pair and connecting to a server from the PuTTY SSH client

You can use both methods side by side but keep in mind that PuTTY stores key files in a specific format which makes them incompatible with SSH key files created with the OpenSSH client. This means that a private key created with the command line SSH client will have to be converted to the PuTTY format first and vice versa.

mkdir ~/.ssh

cd .ssh

ssh-keygen -a 256

ssh-keygen -t rsa -b 4096

Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):

Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:MRk+Y0zCOoOkferhkTvMpcMsYspj212lK7sEauNap user@hostname
The key's randomart image is:
+---[RSA 4096]----+
| .. o |
| . .= o |
| o o X |
|. . . . |
|. .=.o .S. |
| =o.o. . . |
|o + . . o .. |
|.. . . oEoo . |
|o. .o+oo |
+----[SHA256]-----+

cat ~/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8teh2NJ42qYZV98gTNhumO1b6rMYIkAfRVazl
k6dSS3xf2MXJ4YHsDacdjtJ+evXCFBy/IWgdkFtcvsGAMZ2N1RdvhDyQYcy6NDaJCBYw1K6Gv5fJ
SHCiFXvMF0MRRUSMneYlidxUJg9eDvdygny4xOdC6c1JrPrSgOc2nQuKeMpOoOWLINIswg1IIFVk
kFMPrFivP8Z6tidzVpAtbr1sXmJGZazYWrU3FoK2a1sF1zEWrmlMOzX81zEWrmlMOzX8CpZW8Rae
i4ANmLy7NULWK36yU0Rp9bFJ4o0/4PTkZiDCsK0QyHhAJXdLN7ZHpfJtHIPCnexmwIMLfIhCWhO5
 user@hostname

more id_rsa.pub

cat id_rsa.pub

Adding SSH keys to your server

Transferring public keys created on systems based on GNU/Linux, MacOS, or BSD

If you have created your SSH key pairs on a GNU/Linux, MacOS, or BSD based system, you can use the command ssh-copy-id to add the public keys to your server.

The ssh-copy-id utility copies public keys to the file ~/.ssh/authorized_keys on the specified remote server and will automatically create the file in this directory if necessary.

ssh-copy-id user@IP_ADDRESS

By default, ssh-copy-id will try to transfer all public keys inside your local user's ~/.ssh directory. In order to add a single public key, you can specify this key file with the option -i followed by the file path:

ssh-copy-id -i ~/.ssh/KeyFileName user@IP_ADDRESS

Example:

ssh-copy-id -i ~/.ssh/VPS_rsa.pub ubuntu@203.0.113.100

You will be prompted for the user's password. If the process was successful, you will receive a message similar to the one below.

Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'user@server-ip'"
and check to make sure that only the key(s) you wanted were added.

If you receive an error message instead, you can always add your public keys manually by following the steps described below.

Adding public keys to a server manually

Connect to your server and make sure you are in your user's $HOME directory. Create the folder .ssh (if it does not exist):

mkdir ~/.ssh

To store the key for the current user, open (or create) the file authorized_keys with your preferred text editor (nano is used in this example):

nano ~/.ssh/authorized_keys

Paste your public key into this file. Save the file and exit the editor. Reboot your server (sudo reboot) or only restart the OpenSSH service with one of the following commands (the appropriate command may vary depending on your OS):

sudo systemctl restart ssh

sudo systemctl restart sshd

To verify that your key has been set up properly, connect to your server with the following command. Replace "user" with the username for which the keys were created and "IP_ADDRESS" with the IP address (or hostname) of the server you want to access:

ssh user@IP_ADDRESS

Example:

ssh ubuntu@203.0.113.100

Adding additional public keys to your server

To add SSH keys for other users accessing your server, repeat the key creation steps but use the appropriate $HOME folder or Windows Users directory of the user in question to create and store the SSH keys (or execute the commands on this person's dedicated device). Then add the new public key to the server in authorized_keys as described above.

Removing public keys from your server

Open the file authorized_keys as described above and remove the key string that corresponds to the user having their access revoked.

Save the file and exit the editor.

Managing multiple SSH keys on your local device

You might want to use multiple SSH key pairs to connect to different remote hosts.

Since all keys should be placed in the folder .ssh on your local device, the file names have to be different. When you create a new key pair and you are asked to provide a file name, enter a name of your choice. Match it to the name of your server for example.

Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): KeyFileName_rsa
Your identification has been saved in /home/user/.ssh/KeyFileName_rsa.
Your public key has been saved in /home/user/.ssh/KeyFileName_rsa.pub.

When connecting to the corresponding server, specify the name of the key file in addition to the user and server details:

ssh -i ~/.ssh/KeyFileName user@IP_ADDRESS

Example:

ssh -i ~/.ssh/myVPS_rsa ubuntu@203.0.113.100

As noted in previous sections, the same instructions will work on a Windows client. Only replace ~/ with the file path of your Windows user folder, by default C:\Users\WindowsUsername\. (Example: ssh -i C:\Users\Username\.ssh/myVPS_rsa ubuntu@203.0.113.100).

ls ~/.ssh/

config id_rsa id_rsa.pub known_hosts known_hosts.old

Host vps
 HostName 203.0.113.100
 IdentityFile ~/.ssh/myVPS_rsa

ssh ubuntu@vps

Host vps
 HostName 203.0.113.100
 IdentityFile ~/.ssh/myVPS_rsa
Host dedicated_server
 HostName 203.0.113.101
 User rocky
 Port 49160
 IdentityFile ~/.ssh/myserver_rsa

ssh dedicated_server

Importing your SSH key into the OVHcloud Control Panel

The OVHcloud Control Panel allows you to store public keys, if they were created with one of the supported encryption types. This feature can save you some time when you configure a new server or reinstall one because you do not have to add the public key to your server manually.

From the OVHcloud Control Panel:

1. Select your name and initials in the upper-right hand corner.
2. Select My solutions & services from the left-hand navigation menu.
3. In the SSH keys tab, click on Add an SSH key and select class="action"Dedicated from the drop-down menu.

In the new window, enter an ID (a name of your choice) for the key. Paste the key string (copied from your .pub file or the PuTTYgen window) into the Key field.

If you have copied the full output, the identifier after the key should already be appended. Note that to store your key, you will need to specify your local identifier after the pasted key. (See the example format below.) This is a requirement of the OVHcloud Control Panel. Click Confirm to store your public key.

Adding a default rescue SSH key to your server

You can add a default rescue SSH key to your server via the OVHcloud API.

PUT /dedicated/server/{serviceName}

• add your serviceName
• replace rescueSshKey with your rescue key
• delete all other values from the EXAMPLE
• click Try

You can verify the success of this API call through the OVHcloud Control Panel:

1. Select Bare Metal Cloud from the top navigation bar.
2. In the left-hand menu, click Dedicated servers and select your server.
3. Next to Boot click the more options ... button and select Edit.

On the next screen, select Boot in rescue mode and Authentication via SSH key. You can see your current rescue SSH key in the Your Public SSH key field.

Go further

Related articles:

• Getting Started with SSH
• Dedicated server rescue mode
• VPS rescue mode

For more information and tutorials, please see our other Dedicated Servers support guides or explore the guides for other OVHcloud products and services.

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.