--- title: "How to create and use authentication keys for SSH connections to OVHcloud servers" description: "Learn how to create and manage authentication key pairs on your local device and use them to connect to remote servers." url: https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/create-use-authentication-keys-ssh-connections-ovhcloud-server lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # How to create and use authentication keys for SSH connections to OVHcloud servers **Learn how to create and manage authentication key pairs on your local device and use them to connect to remote servers.** The SSH protocol enables a secure communication channel over public networks in a client-server architecture. Key pairs can be used to authenticate these SSH connections between two trusted hosts, for example a desktop client and a remote server. A key set consists of a public key that can be shared and a private key that remains secret. Placed on a server, the public key allows any client that has the corresponding private key to connect to it without the need to enter a password. This method is usually the best compromise between security and convenience.   ## Requirements - A [Dedicated Server](https://us.ovhcloud.com/bare-metal/) or a [VPS](https://us.ovhcloud.com/vps/) - A remote connection client application compatible with the OpenSSH protocol **Note:** This guide is not applicable for standard **Windows Server** installations since they rely on the `Remote Desktop Protocol` (RDP) for connections. However, SSH connections are used for the OVHcloud rescue mode. You can find more information in the [Go further](#go-further) section of this guide.   ## Topics - [Creating an SSH key pair](#creating-an-ssh-key-pair) - [Adding SSH keys to your server](#adding-ssh-keys-to-your-server) - [Managing multiple SSH keys on your local device](#managing-multiple-ssh-keys-on-your-local-device) - [Importing your SSH key into the OVHcloud Control Panel](#importing-your-ssh-key-into-the-OVHcloud-Control-Panel) - [Adding a default rescue SHH key to your server](#adding-a-default-rescue-ssh-key-to-your-server)   ## Instructions Be sure to consult our "Getting Started" guides: - For a [dedicated server](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/getting-started-dedicated-server-windows-linux.md) - For a [dedicated server of the **Eco** product line](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/getting-started-with-dedicated-server-eco.md) - For a [VPS](https://docs.us.ovhcloud.com/en/bare-metal-cloud/vps/starting-with-a-vps.md)   ### Creating key pairs for OpenSSH connections The following instructions cover two methods of using SSH keys: - Creating an **OpenSSH** key pair and connecting to a server from the command line SSH client - Creating a **PuTTY** key pair and connecting to a server from the **PuTTY** SSH client You can use both methods side by side but keep in mind that **PuTTY** stores key files in a specific format which makes them incompatible with SSH key files created with the **OpenSSH** client. This means that a private key created with the command line SSH client will have to be [converted to the PuTTY format](https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-ssh2-keyfmt) first and vice versa. #### Command Line #### Creating an SSH key pair from the command line From a **Mac** computer or a device with a **Linux OS** installed, open the command line application (**Terminal**)**.** Verify that you have a folder named `.ssh` in your `$HOME` directory. If the folder does not exist, create it: ``` mkdir ~/.ssh ``` On a current **Windows OS**, open the command prompt by typing "cmd" into the search bar (or open Powershell from the menu). Go to the directory `.ssh` for your active **Windows** user (by default: `C:\Users\WindowsUsername\.ssh`): ``` cd .ssh ``` Use the following command to create a 4096 bit ED25519 key: ``` ssh-keygen -a 256 ``` Using the option `-t` with this command allows you to specify a different encryption method, for example: ``` ssh-keygen -t rsa -b 4096 ``` The command line will prompt you to save the newly created key in the standard file: ``` Generating public/private rsa key pair. Enter file in which to save the key (/home/user/.ssh/id_rsa): ``` You can confirm with `Enter` to accept the proposed file name or enter an individual name. This is relevant if more than one key pair is placed in the `.ssh` directory. You can find more information about this in the section on [managing multiple SSH keys](#managing-multiple-ssh-keys-on-your-local-device).\ This example uses the standard file names `id_rsa` and `id_rsa.pub`. You can protect your SSH key with a passphrase at the next prompt. This is recommended for added security. **Warning:** **NOTE:** Remote access to your server is only as secure as the client device storing the private key. Protecting your device and files from unauthorized access is therefore crucial when using SSH keys.\ For convenience and security purposes, consider using a password manager on your device, such as the open source solution **KeePass**. All SSH keys should be stored in the `.ssh` directory. The public key files will have `.pub` added to the filename. ``` Your identification has been saved in /home/user/.ssh/id_rsa. Your public key has been saved in /home/user/.ssh/id_rsa.pub. The key fingerprint is: SHA256:MRk+Y0zCOoOkferhkTvMpcMsYspj212lK7sEauNap user@hostname The key's randomart image is: +---[RSA 4096]----+ | .. o | | . .= o | | o o X | |. . . . | |. .=.o .S. | | =o.o. . . | |o + . . o .. | |.. . . oEoo . | |o. .o+oo | +----[SHA256]-----+ ``` To view and export your public key, use the command `cat` on your `.pub` key file. Copy the full key string to the clipboard to [add it to your server](#add-server-key) next. ``` cat ~/.ssh/id_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8teh2NJ42qYZV98gTNhumO1b6rMYIkAfRVazl k6dSS3xf2MXJ4YHsDacdjtJ+evXCFBy/IWgdkFtcvsGAMZ2N1RdvhDyQYcy6NDaJCBYw1K6Gv5fJ SHCiFXvMF0MRRUSMneYlidxUJg9eDvdygny4xOdC6c1JrPrSgOc2nQuKeMpOoOWLINIswg1IIFVk kFMPrFivP8Z6tidzVpAtbr1sXmJGZazYWrU3FoK2a1sF1zEWrmlMOzX81zEWrmlMOzX8CpZW8Rae i4ANmLy7NULWK36yU0Rp9bFJ4o0/4PTkZiDCsK0QyHhAJXdLN7ZHpfJtHIPCnexmwIMLfIhCWhO5 user@hostname ``` **Note:** In a **MacOS** Terminal you can use the commands `pbcopy` and `pbpaste` to handle key strings faster. For example, use this command to copy the key from the file `id_rsa.pub` to the clipboard: `pbcopy < ~/.ssh/id_rsa.pub` On a **Windows OS**, you can open the file with the `Notepad` application from the `File Explorer` (`right-click` on the file and select `Open with`) or use one of the following commands (in `\Users\WindowsUsername\.ssh`): - `cmd` ``` more id_rsa.pub ``` - `powershell` ``` cat id_rsa.pub ``` Copy the full key string to the clipboard to [add it to your server](#add-server-key) next. **Note:** **Clipboard usage:**\ When working from a **Windows** command line, use a `right-click` to **paste** the content of your clipboard into the command line window. To **copy** a string from the command line window, highlight it, then press `Enter`. You can also find these functions via a `right-click` on the menu bar. ##### PuTTY #### Creating an SSH key pair with PuTTY [PuTTY](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html) is an open source SSH client software with a graphical user interface, available for **Windows** and other operating systems. It provides a companion software to create SSH keys: PuTTY Key Generator (PuTTY gen). **Note:** The main purpose of PuTTY is managing SSH connections from a **Windows** client device to a **GNU/Linux** server. PuTTY stores key files in a specific format which makes them incompatible with SSH key files created with the **OpenSSH** client natively included in most modern operating systems.\ If necessary, keys generated from the command line as explained above can be [converted into the PPK format](https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-ssh2-keyfmt) in order to use them with the PuTTY client. For the most convenient use of SSH keys, decide on an option and stick to it (**OpenSSH** private keys or PuTTY private keys). If it is not already installed (check your applications list or use the search function), download PuTTY from [the official website](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html). The recommended standard installation package contains PuTTYgen but it is available as a standalone file on the website as well. Open PuTTYgen and select a supported encryption algorithm. This example uses RSA. Enter 4096 as the number of bits in the bottom right corner, then click on the button `Generate`. Move your mouse cursor freely about the area below the progress bar: The key is ready when the progress bar is full. Copy the full key string to the clipboard in order to [add it to your server](#add-server-key) and optionally [import it into the OVHcloud Control Panel](#import-manager). Save both keys as files by clicking the corresponding buttons and also enter a passphrase to protect them. **Warning:** **NOTE:** Remote access to your server is only as secure as the client device storing the private key. Protecting your device and files from unauthorized access is therefore crucial when using SSH keys.\ For convenience and security purposes, consider using a password manager on your device, such as the open-source solution KeePass. One advantage of using PuTTY is the ability to save different connections as **Sessions**. Find further information below in the section on [managing multiple SSH keys on your local device](#managing-multiple-ssh-keys-on-your-local-device). You can learn more about SSH connections in the ["Getting Started" guides](#instructions) and in our [SSH introduction](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/ssh-introduction.md).   ### Adding SSH keys to your server #### Transferring public keys created on systems based on GNU/Linux, MacOS, or BSD If you have created your SSH key pairs on a GNU/Linux, MacOS, or BSD based system, you can use the command `ssh-copy-id` to add the public keys to your server. The `ssh-copy-id` utility copies public keys to the file `~/.ssh/authorized_keys` on the specified remote server and will automatically create the file in this directory if necessary. ``` ssh-copy-id user@IP_ADDRESS ``` By default, `ssh-copy-id` will try to transfer all public keys inside your local user's `~/.ssh` directory. In order to add a single public key, you can specify this key file with the option `-i` followed by the file path: ``` ssh-copy-id -i ~/.ssh/KeyFileName user@IP_ADDRESS ``` Example: ``` ssh-copy-id -i ~/.ssh/VPS_rsa.pub ubuntu@203.0.113.100 ``` You will be prompted for the user's password. If the process was successful, you will receive a message similar to the one below. ``` Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'user@server-ip'" and check to make sure that only the key(s) you wanted were added. ``` If you receive an error message instead, you can always add your public keys manually by following the steps described below. **Note:** As a best practice and for security reasons, a single key pair should not be used by multiple users. Since each user on GNU/Linux systems has their own `authorized_keys` file in `~/.ssh/`, you can use the command `ssh-copy-id` as shown above and adapt `KeyFileName` and `user` after you have [created the key pair](#create-ssh).   #### Adding public keys to a server manually [Connect](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/ssh-introduction.md) to your server and make sure you are in your user's `$HOME` directory. Create the folder `.ssh` (if it does not exist): ``` mkdir ~/.ssh ``` To store the key for the current user, open (or create) the file `authorized_keys` with your preferred text editor (`nano` is used in this example): ``` nano ~/.ssh/authorized_keys ``` Paste your [public key](#create-ssh) into this file. Save the file and exit the editor. Reboot your server (`sudo reboot`) or only restart the OpenSSH service with one of the following commands (the appropriate command may vary depending on your OS): ``` sudo systemctl restart ssh ``` ``` sudo systemctl restart sshd ``` To verify that your key has been set up properly, connect to your server with the following command. Replace "user" with the username for which the keys were created and "IP\_ADDRESS" with the IP address (or hostname) of the server you want to access: ``` ssh user@IP_ADDRESS ``` Example: ``` ssh ubuntu@203.0.113.100 ```   #### Adding additional public keys to your server To add SSH keys for other users accessing your server, repeat the key creation steps but use the appropriate `$HOME` folder or **Windows** `Users` directory of the user in question to create and store the SSH keys (or execute the commands on this person's dedicated device). Then add the new public key to the server in `authorized_keys` as described above.   #### Removing public keys from your server Open the file `authorized_keys` as [described above](#add-server-key) and remove the key string that corresponds to the user having their access revoked. Save the file and exit the editor.   ### Managing multiple SSH keys on your local device You might want to use multiple SSH key pairs to connect to different remote hosts. Since all keys should be placed in the folder `.ssh` on your local device, the file names have to be different. When you [create a new key pair](#create-ssh) and you are asked to provide a file name, enter a name of your choice. Match it to the name of your server for example. ``` Generating public/private rsa key pair. Enter file in which to save the key (/home/user/.ssh/id_rsa): KeyFileName_rsa Your identification has been saved in /home/user/.ssh/KeyFileName_rsa. Your public key has been saved in /home/user/.ssh/KeyFileName_rsa.pub. ``` When connecting to the corresponding server, specify the name of the key file in addition to the user and server details: ``` ssh -i ~/.ssh/KeyFileName user@IP_ADDRESS ``` Example: ``` ssh -i ~/.ssh/myVPS_rsa ubuntu@203.0.113.100 ``` As noted in previous sections, the same instructions will work on a **Windows** client. Only replace `~/` with the file path of your **Windows** user folder, by default `C:\Users\WindowsUsername\`. (Example: `ssh -i C:\Users\Username\.ssh/myVPS_rsa ubuntu@203.0.113.100`). **Using "config" file** The alternative to adding the option `-i` each time is to edit a file named `config` inside the folder `~/.ssh` (`\Users\Username\.ssh` for **Windows**). You can use it to configure details for different connections (username, port, key file, optional parameters, etc.) If this file exists inside `.ssh`, it probably contains some information already. Depending on your working environment, consider creating a backup copy of the original first. Example of `.ssh` folder content: ``` ls ~/.ssh/ ``` ``` config id_rsa id_rsa.pub known_hosts known_hosts.old ``` With the `config` file, multiple SSH connections can be stored along with their individual parameters, in addition to standard values. Using the full potential of this file can become complex, since it is most useful for experienced users managing multiple servers on a regular basis. Following is a simple example to explain how to configure an SSH connection to a VPS.\ Open the file and add the following lines at the top: ``` Host vps HostName 203.0.113.100 IdentityFile ~/.ssh/myVPS_rsa ``` You can then connect to the VPS with the alias name you have defined as `Host`: ``` ssh ubuntu@vps ``` Only the server IP and the key file were specified in the previous example but more details can be added. To configure an SSH connection to a second server with the username "rocky", the [modified SSH port](https://docs.us.ovhcloud.com/en/bare-metal-cloud/vps/secure-your-vps.md#changing-the-default-ssh-listening-port) "49160" and the private key in the file "myserver\_rsa", extend the file content as shown in this example: ``` Host vps HostName 203.0.113.100 IdentityFile ~/.ssh/myVPS_rsa Host dedicated_server HostName 203.0.113.101 User rocky Port 49160 IdentityFile ~/.ssh/myserver_rsa ``` You can then connect to this server by entering: ``` ssh dedicated_server ``` You can read the [corresponding man page](https://manpages.org/ssh_config/5) for more information. #### Using PuTTY If you have followed the instructions in the sections [Creating an SSH key pair with PuTTY](#create-ssh) and [Adding SSH keys to your server](#add-server-key), you have a key pair you can use to connect to your server. PuTTY can save credentials and parameters of an SSH connection as a **Session**. This also enables you to connect to different servers using individual keys. Open PuTTY and expand the subsection `SSH` in the left-hand menu, then click on `Auth` and `Credentials`. Click on the `Browse` button and select the PuTTY private key file (`keyfile.ppk`) from the folder in which you have saved it. The key file is now associated with the current SSH session. Switch to `Session` in the left-hand menu and enter your [login credentials for the server](#create-ssh) (`username@IPv4_address`). Enter a name for this connection under `Saved Sessions` and click on `Save` to add it to the list. From now on, you can click on this `Session` item and open a connection to your server. To test it, click on `Open`. If you have protected the key file with a passphrase, you have to enter it at this point. To configure another server connection, repeat the steps: - [Create the key pair](#create-ssh) - [Add the public key to your server](#add-server-key) - [Enter the server details and add the key file in PuTTY](#managing-multiple-ssh-keys-on-your-local-device)   ### Importing your SSH key into the OVHcloud Control Panel The OVHcloud Control Panel allows you to store public keys, if they were created with one of the supported encryption types. This feature can save you some time when you configure a new server or reinstall one because you do not have to [add the public key to your server](#add-server-key) manually. From the OVHcloud Control Panel: 1. Select your `name` and `initials` in the upper-right hand corner. 2. Select `My solutions & services` from the left-hand navigation menu. 3. In the **SSH keys** tab, click on `Add an SSH key` and select `class="action"Dedicated` from the drop-down menu.   In the new window, enter an ID (a name of your choice) for the key. Paste the key string (copied from [your `.pub` file](#create-ssh) or [the `PuTTYgen` window](#create-ssh)) into the **Key** field. If you have copied the full output, the identifier after the key should already be appended. Note that to store your key, you will need to specify your local identifier after the pasted key. (See the example format below.) This is a requirement of the OVHcloud Control Panel. Click `Confirm` to store your public key. **Note:** All keys saved in the **Dedicated** section are available to preinstall on a dedicated server or a VPS. Regarding SSH keys for Public Cloud services, please refer to [this guide](https://docs.us.ovhcloud.com/en/public-cloud/compute/getting-started.md).   ### Adding a default rescue SSH key to your server You can add a default rescue SSH key to your server via the [OVHcloud API](https://api.us.ovhcloud.com/). [PUT /dedicated/server/{serviceName}](https://api.us.ovhcloud.com/console/?section=/dedicated/server&branch=v1#put-/dedicated/server/-serviceName-) - add your **serviceName** - replace **rescueSshKey** with your rescue key - delete all other values from the EXAMPLE - click `Try`   You can verify the success of this API call through the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/): 1. Select `Bare Metal Cloud` from the top navigation bar. 2. In the left-hand menu, click `Dedicated servers` and select your server. 3. Next to **Boot** click the _more options_ `...` button and select `Edit`. On the next screen, select `Boot in rescue mode` and `Authentication via SSH key`. You can see your current rescue SSH key in the **Your Public SSH key** field.   ## Go further Related articles: - [Getting Started with SSH](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/ssh-introduction.md) - [Dedicated server rescue mode](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/rescue-mode.md) - [VPS rescue mode](https://docs.us.ovhcloud.com/en/bare-metal-cloud/vps/recover-rescue-mode.md) Browse all the [Dedicated Servers guides](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/landing-page-dedicated-servers.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Dedicated Servers](https://us.ovhcloud.com/bare-metal/) on the OVHcloud US website. If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://us.ovhcloud.com/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.