How to create and use authentication keys for SSH connections to OVHcloud servers

View as Markdown

Learn how to create and manage authentication key pairs on your local device and use them to connect to remote servers.

The SSH protocol enables a secure communication channel over public networks in a client-server architecture. Key pairs can be used to authenticate these SSH connections between two trusted hosts, for example a desktop client and a remote server.

A key set consists of a public key that can be shared and a private key that remains secret. Placed on a server, the public key allows any client that has the corresponding private key to connect to it without the need to enter a password.

This method is usually the best compromise between security and convenience.

Requirements

A Dedicated Server or a VPS
A remote connection client application compatible with the OpenSSH protocol

Info

This guide is not applicable for standard Windows Server installations since they rely on the Remote Desktop Protocol (RDP) for connections. However, SSH connections are used for the OVHcloud rescue mode. You can find more information in the Go further section of this guide.

Topics

Creating an SSH key pair
Adding SSH keys to your server
Managing multiple SSH keys on your local device
Importing your SSH key into the OVHcloud Control Panel
Adding a default rescue SHH key to your server

Instructions

Be sure to consult our "Getting Started" guides:

For a dedicated server
For a dedicated server of the Eco product line
For a VPS

Creating key pairs for OpenSSH connections

The following instructions cover two methods of using SSH keys:

Creating an OpenSSH key pair and connecting to a server from the command line SSH client
Creating a PuTTY key pair and connecting to a server from the PuTTY SSH client

You can use both methods side by side but keep in mind that PuTTY stores key files in a specific format which makes them incompatible with SSH key files created with the OpenSSH client. This means that a private key created with the command line SSH client will have to be converted to the PuTTY format first and vice versa.

Command Line

PuTTY

Creating an SSH key pair from the command line

From a Mac computer or a device with a Linux OS installed, open the command line application (Terminal).

Verify that you have a folder named .ssh in your $HOME directory. If the folder does not exist, create it:

mkdir ~/.ssh

On a current Windows OS, open the command prompt by typing "cmd" into the search bar (or open Powershell from the menu).

Go to the directory .ssh for your active Windows user (by default: C:\Users\WindowsUsername\.ssh):

cd .ssh

Use the following command to create a 4096 bit ED25519 key:

ssh-keygen -a 256

Using the option -t with this command allows you to specify a different encryption method, for example:

ssh-keygen -t rsa -b 4096

The command line will prompt you to save the newly created key in the standard file:

Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):

You can confirm with Enter to accept the proposed file name or enter an individual name. This is relevant if more than one key pair is placed in the .ssh directory. You can find more information about this in the section on managing multiple SSH keys.
This example uses the standard file names id_rsa and id_rsa.pub.

You can protect your SSH key with a passphrase at the next prompt. This is recommended for added security.

Warning

NOTE: Remote access to your server is only as secure as the client device storing the private key. Protecting your device and files from unauthorized access is therefore crucial when using SSH keys.
For convenience and security purposes, consider using a password manager on your device, such as the open source solution KeePass.

All SSH keys should be stored in the .ssh directory. The public key files will have .pub added to the filename.

Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:MRk+Y0zCOoOkferhkTvMpcMsYspj212lK7sEauNap user@hostname
The key's randomart image is:
+---[RSA 4096]----+
| .. o |
| . .= o |
| o o X |
|. . . . |
|. .=.o .S. |
| =o.o. . . |
|o + . . o .. |
|.. . . oEoo . |
|o. .o+oo |
+----[SHA256]-----+

To view and export your public key, use the command cat on your .pub key file. Copy the full key string to the clipboard to add it to your server next.

cat ~/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8teh2NJ42qYZV98gTNhumO1b6rMYIkAfRVazl
k6dSS3xf2MXJ4YHsDacdjtJ+evXCFBy/IWgdkFtcvsGAMZ2N1RdvhDyQYcy6NDaJCBYw1K6Gv5fJ
SHCiFXvMF0MRRUSMneYlidxUJg9eDvdygny4xOdC6c1JrPrSgOc2nQuKeMpOoOWLINIswg1IIFVk
kFMPrFivP8Z6tidzVpAtbr1sXmJGZazYWrU3FoK2a1sF1zEWrmlMOzX81zEWrmlMOzX8CpZW8Rae
i4ANmLy7NULWK36yU0Rp9bFJ4o0/4PTkZiDCsK0QyHhAJXdLN7ZHpfJtHIPCnexmwIMLfIhCWhO5
 user@hostname

Info

In a MacOS Terminal you can use the commands pbcopy and pbpaste to handle key strings faster. For example, use this command to copy the key from the file id_rsa.pub to the clipboard: pbcopy < ~/.ssh/id_rsa.pub

On a Windows OS, you can open the file with the Notepad application from the File Explorer (right-click on the file and select Open with) or use one of the following commands (in \Users\WindowsUsername\.ssh):

cmd

more id_rsa.pub

powershell

cat id_rsa.pub

Copy the full key string to the clipboard to add it to your server next.

Info

Clipboard usage:
When working from a Windows command line, use a right-click to paste the content of your clipboard into the command line window. To copy a string from the command line window, highlight it, then press Enter. You can also find these functions via a right-click on the menu bar.

Creating an SSH key pair with PuTTY

PuTTY is an open source SSH client software with a graphical user interface, available for Windows and other operating systems. It provides a companion software to create SSH keys: PuTTY Key Generator (PuTTY gen).

Info

The main purpose of PuTTY is managing SSH connections from a Windows client device to a GNU/Linux server. PuTTY stores key files in a specific format which makes them incompatible with SSH key files created with the OpenSSH client natively included in most modern operating systems.
If necessary, keys generated from the command line as explained above can be converted into the PPK format in order to use them with the PuTTY client. For the most convenient use of SSH keys, decide on an option and stick to it (OpenSSH private keys or PuTTY private keys).

If it is not already installed (check your applications list or use the search function), download PuTTY from the official website. The recommended standard installation package contains PuTTYgen but it is available as a standalone file on the website as well.

Open PuTTYgen and select a supported encryption algorithm. This example uses RSA. Enter 4096 as the number of bits in the bottom right corner, then click on the button Generate.

PuTTYgen - Create use authentication keys SSH connections OVHcloud server

Move your mouse cursor freely about the area below the progress bar:

PuTTYgen - Create use authentication keys SSH connections OVHcloud server

The key is ready when the progress bar is full.

PuTTYgen - Create use authentication keys SSH connections OVHcloud server - step 2

Copy the full key string to the clipboard in order to add it to your server and optionally import it into the OVHcloud Control Panel. Save both keys as files by clicking the corresponding buttons and also enter a passphrase to protect them.

Warning

One advantage of using PuTTY is the ability to save different connections as Sessions. Find further information below in the section on managing multiple SSH keys on your local device.

You can learn more about SSH connections in the "Getting Started" guides and in our SSH introduction.

Adding SSH keys to your server

Transferring public keys created on systems based on GNU/Linux, MacOS, or BSD

If you have created your SSH key pairs on a GNU/Linux, MacOS, or BSD based system, you can use the command ssh-copy-id to add the public keys to your server.

The ssh-copy-id utility copies public keys to the file ~/.ssh/authorized_keys on the specified remote server and will automatically create the file in this directory if necessary.

ssh-copy-id user@IP_ADDRESS

By default, ssh-copy-id will try to transfer all public keys inside your local user's ~/.ssh directory. In order to add a single public key, you can specify this key file with the option -i followed by the file path:

ssh-copy-id -i ~/.ssh/KeyFileName user@IP_ADDRESS

Example:

ssh-copy-id -i ~/.ssh/VPS_rsa.pub ubuntu@203.0.113.100

You will be prompted for the user's password. If the process was successful, you will receive a message similar to the one below.

Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'user@server-ip'"
and check to make sure that only the key(s) you wanted were added.

If you receive an error message instead, you can always add your public keys manually by following the steps described below.

Info

As a best practice and for security reasons, a single key pair should not be used by multiple users. Since each user on GNU/Linux systems has their own authorized_keys file in ~/.ssh/, you can use the command ssh-copy-id as shown above and adapt KeyFileName and user after you have created the key pair.

Adding public keys to a server manually

Connect to your server and make sure you are in your user's $HOME directory. Create the folder .ssh (if it does not exist):

mkdir ~/.ssh

To store the key for the current user, open (or create) the file authorized_keys with your preferred text editor (nano is used in this example):

nano ~/.ssh/authorized_keys

Paste your public key into this file. Save the file and exit the editor. Reboot your server (sudo reboot) or only restart the OpenSSH service with one of the following commands (the appropriate command may vary depending on your OS):

sudo systemctl restart ssh

sudo systemctl restart sshd

To verify that your key has been set up properly, connect to your server with the following command. Replace "user" with the username for which the keys were created and "IP_ADDRESS" with the IP address (or hostname) of the server you want to access:

ssh user@IP_ADDRESS

Example:

ssh ubuntu@203.0.113.100

Adding additional public keys to your server

To add SSH keys for other users accessing your server, repeat the key creation steps but use the appropriate $HOME folder or Windows Users directory of the user in question to create and store the SSH keys (or execute the commands on this person's dedicated device). Then add the new public key to the server in authorized_keys as described above.

Removing public keys from your server

Open the file authorized_keys as described above and remove the key string that corresponds to the user having their access revoked.

Save the file and exit the editor.

Managing multiple SSH keys on your local device

You might want to use multiple SSH key pairs to connect to different remote hosts.

Since all keys should be placed in the folder .ssh on your local device, the file names have to be different. When you create a new key pair and you are asked to provide a file name, enter a name of your choice. Match it to the name of your server for example.

Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): KeyFileName_rsa
Your identification has been saved in /home/user/.ssh/KeyFileName_rsa.
Your public key has been saved in /home/user/.ssh/KeyFileName_rsa.pub.

When connecting to the corresponding server, specify the name of the key file in addition to the user and server details:

ssh -i ~/.ssh/KeyFileName user@IP_ADDRESS

Example:

ssh -i ~/.ssh/myVPS_rsa ubuntu@203.0.113.100

As noted in previous sections, the same instructions will work on a Windows client. Only replace ~/ with the file path of your Windows user folder, by default C:\Users\WindowsUsername\. (Example: ssh -i C:\Users\Username\.ssh/myVPS_rsa ubuntu@203.0.113.100).

Using "config" file

Using PuTTY

The alternative to adding the option -i each time is to edit a file named config inside the folder ~/.ssh (\Users\Username\.ssh for Windows). You can use it to configure details for different connections (username, port, key file, optional parameters, etc.)

If this file exists inside .ssh, it probably contains some information already. Depending on your working environment, consider creating a backup copy of the original first.

Example of .ssh folder content:

ls ~/.ssh/

config id_rsa id_rsa.pub known_hosts known_hosts.old

With the config file, multiple SSH connections can be stored along with their individual parameters, in addition to standard values. Using the full potential of this file can become complex, since it is most useful for experienced users managing multiple servers on a regular basis.

Following is a simple example to explain how to configure an SSH connection to a VPS.
Open the file and add the following lines at the top:

Host vps
 HostName 203.0.113.100
 IdentityFile ~/.ssh/myVPS_rsa

You can then connect to the VPS with the alias name you have defined as Host:

ssh ubuntu@vps

Only the server IP and the key file were specified in the previous example but more details can be added. To configure an SSH connection to a second server with the username "rocky", the modified SSH port "49160" and the private key in the file "myserver_rsa", extend the file content as shown in this example:

Host vps
 HostName 203.0.113.100
 IdentityFile ~/.ssh/myVPS_rsa
Host dedicated_server
 HostName 203.0.113.101
 User rocky
 Port 49160
 IdentityFile ~/.ssh/myserver_rsa

You can then connect to this server by entering:

ssh dedicated_server

You can read the corresponding man page for more information.

If you have followed the instructions in the sections Creating an SSH key pair with PuTTY and Adding SSH keys to your server, you have a key pair you can use to connect to your server.

PuTTY can save credentials and parameters of an SSH connection as a Session. This also enables you to connect to different servers using individual keys.

Open PuTTY and expand the subsection SSH in the left-hand menu, then click on Auth and Credentials.

Manage - Create use authentication keys SSH connections OVHcloud server

Click on the Browse button and select the PuTTY private key file (keyfile.ppk) from the folder in which you have saved it.

The key file is now associated with the current SSH session. Switch to Session in the left-hand menu and enter your login credentials for the server (username@IPv4_address).

Enter a name for this connection under Saved Sessions and click on Save to add it to the list.

Manage - Create use authentication keys SSH connections OVHcloud server - step 2

From now on, you can click on this Session item and open a connection to your server. To test it, click on Open. If you have protected the key file with a passphrase, you have to enter it at this point.

To configure another server connection, repeat the steps:

Create the key pair
Add the public key to your server
Enter the server details and add the key file in PuTTY

Importing your SSH key into the OVHcloud Control Panel

The OVHcloud Control Panel allows you to store public keys, if they were created with one of the supported encryption types. This feature can save you some time when you configure a new server or reinstall one because you do not have to add the public key to your server manually.

From the OVHcloud Control Panel:

Select your name and initials in the upper-right hand corner.
Select My solutions & services from the left-hand navigation menu.
In the SSH keys tab, click on Add an SSH key and select class="action"Dedicated from the drop-down menu.

Create use authentication keys SSH connections OVHcloud server - step 1

In the new window, enter an ID (a name of your choice) for the key. Paste the key string (copied from your .pub file or the PuTTYgen window) into the Key field.

If you have copied the full output, the identifier after the key should already be appended. Note that to store your key, you will need to specify your local identifier after the pasted key. (See the example format below.) This is a requirement of the OVHcloud Control Panel. Click Confirm to store your public key.

Info

All keys saved in the Dedicated section are available to preinstall on a dedicated server or a VPS. Regarding SSH keys for Public Cloud services, please refer to this guide.

Create use authentication keys SSH connections OVHcloud server - step 2

Adding a default rescue SSH key to your server

You can add a default rescue SSH key to your server via the OVHcloud API.

PUT/dedicated/server/{serviceName}

add your serviceName
replace rescueSshKey with your rescue key
delete all other values from the EXAMPLE
click Try

Rescue - Create use authentication keys SSH connections OVHcloud server

You can verify the success of this API call through the OVHcloud Control Panel:

Select Bare Metal Cloud from the top navigation bar.
In the left-hand menu, click Dedicated servers and select your server.
Next to Boot click the more options ... button and select Edit.

Rescue - Create use authentication keys SSH connections OVHcloud server - step 2

On the next screen, select Boot in rescue mode and Authentication via SSH key. You can see your current rescue SSH key in the Your Public SSH key field.

Rescue - Create use authentication keys SSH connections OVHcloud server - step 3

Go further

Browse all the Dedicated Servers guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.

Learn more about Dedicated Servers on the OVHcloud US website.

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.