--- title: "How to create and use authentication keys for SSH connections to Public Cloud instances" description: "Learn how to create and manage authentication key pairs on your local device and use them to connect to Public Cloud instances." url: https://docs.us.ovhcloud.com/en/public-cloud/compute/creating-ssh-keys lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # How to create and use authentication keys for SSH connections to Public Cloud instances **Learn how to create and manage authentication key pairs on your local device and use them to connect to Public Cloud instances.** The SSH protocol enables a secure channel over public networks in a client-server architecture. Key pairs can be used to authenticate these SSH connections between two trusted hosts, for example a desktop client and a remote server. A key consists of a public key that can be shared and a private key that remains secret. Placed on a server, the public key allows any client that has the corresponding private key to connect to it without the need to enter a password. This is usually the best compromise between security and convenience and the default for Public Cloud instances.   ## Requirements - A [Public Cloud project](https://us.ovhcloud.com/public-cloud/) in your OVHcloud account - A remote connection client application compatible with the OpenSSH protocol **Note:** This guide is not applicable for standard **Windows Server** installations since they rely on the `Remote Desktop Protocol` (RDP) for connections. You can find more information in our [create a Public Cloud instance](https://docs.us.ovhcloud.com/en/public-cloud/compute/getting-started.md) guide.   ## Instructions ### Creating key pairs for OpenSSH connections The following instructions will explain how to create and manage key pairs for remote connections with OpenSSH from the command line. Most current operating systems include this feature without needing to install additional software. If you prefer a graphical user interface, you can find many software applications for every type of OS that enable you to connect to remote hosts via the OpenSSH protocol. For example, [PuTTY](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html) is an open-source SSH client software with many useful features. Find out how to use it for connections to OVHcloud servers and instance in our detailed tutorial, [How to use PuTTY](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/ssh-using-putty-on-windows.md). **Note:** If you receive error messages when trying to connect, ensure you are using the correct parameters and login details and that your system and the installed applications are properly updated. If you receive a warning message of the type `REMOTE HOST IDENTIFICATION HAS CHANGED`, consult our [SSH introduction page](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/ssh-introduction.md). #### How to configure key pairs from a GNU/Linux distribution or MacOS **Creating an SSH key pair from the command line** Open the command line application (`Terminal`). Verify that you have a folder named `.ssh` in your `$HOME` directory. If the folder does not exist, create it: ```bash mkdir ~/.ssh ``` Use the command `ssh-keygen` to create a key pair. The option `-t` allows you to specify the encryption method. **Note:** `Ed25519` is considered the most secure but `RSA` is a valid alternative. Both methods are compatible with the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/). Examples: ```bash ssh-keygen -t ed25519 -a 100 ``` ```bash ssh-keygen -t rsa -b 4096 -a 100 ``` The next prompt allows you to name the newly created key or use the standard file name: ``` Generating public/private rsa key pair. Enter file in which to save the key (/home/user/.ssh/id_rsa): ``` If you confirm with `Enter` without entering a name, the standard file name will be used (`id_rsa` in this example). If you plan to use more than one key paiur in the future, enter an individual file name to identify the key. You can find more information about this below in the **Managing multiple authentication keys on your local device section**.\ This example outputs below will keep using the standard file names `id_rsa` and `id_rsa.pub` for illustration purposes. You can protect your SSH key with a passphrase at the next prompt. This is recommended for added security. **Warning:** **NOTE:** Remote access to your instance is only as secure as the client device storing the private key. Protecting your device and files from unauthorized access is therefore crucial when using SSH keys. For increased convenience and security, store passphrases in a password manager on your device, such as the open-source solution `KeePass`. All SSH keys should be stored in the `.ssh` directory. The public key files will have `.pub` added to the filename. ``` Your identification has been saved in /home/user/.ssh/id_rsa. Your public key has been saved in /home/user/.ssh/id_rsa.pub. The key fingerprint is: SHA256:MRk+Y0zCOoOkferhkTvMpcMsYspj212lK7sEauNap user@hostname The key's randomart image is: +---[RSA 4096]----+ | .. o | | . .= o | | o o X | |. . . . | |. .=.o .S. | | =o.o. . . | |o + . . o .. | |.. . . oEoo . | |o. .o+oo | +----[SHA256]-----+ ``` To view and export your public key, use the command `cat` on your `.pub` key file or open it with a text editor. ```bash cat ~/.ssh/id_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8teh2NJ42qYZV98gTNhumO1b6rMYIkAfRVazl k6dSS3xf2MXJ4YHsDacdjtJ+evXCFBy/IWgdkFtcvsGAMZ2N1RdvhDyQYcy6NDaJCBYw1K6Gv5fJ SHCiFXvMF0MRRUSMneYlidxUJg9eDvdygny4xOdC6c1JrPrSgOc2nQuKeMpOoOWLINIswg1IIFVk kFMPrFivP8Z6tidzVpAtbr1sXmJGZazYWrU3FoK2a1sF1zEWrmlMOzX81zEWrmlMOzX8CpZW8Rae i4ANmLy7NULWK36yU0Rp9bFJ4o0/4PTkZiDCsK0QyHhAJXdLN7ZHpfJtHIPCnexmwIMLfIhCWhO5 user@hostname ``` Copy this key string to [add it to a new instance](https://docs.us.ovhcloud.com/en/public-cloud/compute/getting-started.md#step-4-create-the-instance) or to [import it into the OVHcloud Control Panel](https://docs.us.ovhcloud.com/en/public-cloud/compute/getting-started.md#step-2-import-ssh-keys). **Note:** In a **MacOS** Terminal you can use the commands `pbcopy` and `pbpaste` to handle key strings faster. For example, use this command to copy the key from the file `id_rsa.pub` to the clipboard: `pbcopy < ~/.ssh/id_rsa.pub`   **Managing multiple SSH keys on your local device** You might want to use multiple SSH key pairs to connect to different remote hosts or local network devices. Since all keys should be placed in the folder `.ssh` of your user's `home` directory, the file names have to be different. When you create a new key pair and you are asked to provide a file name, enter a name of your choice, for example the name of your instance. Example output: ``` Generating public/private rsa key pair. Enter file in which to save the key (/home/user/.ssh/id_rsa): KeyFileName_rsa Your identification has been saved in /home/user/.ssh/KeyFileName_rsa. Your public key has been saved in /home/user/.ssh/KeyFileName_rsa.pub. ``` When connecting to the corresponding server, specify the name of the private key file in addition to the user and server details: ```bash ssh -i ~/.ssh/KeyFileName user@IP_ADDRESS ``` Example: ```bash ssh -i ~/.ssh/myInstance_rsa ubuntu@203.0.113.100 ```   _Using the "config" file_ The alternative to adding the option `-i` each time is to edit a file named `config` inside the folder `~/.ssh`. You can use it to configure details for different connections (username, port, key file, optional parameters, etc.) If this file exists inside `.ssh`, it probably contains some information already. Depending on your working environment, consider creating a backup copy of the original first. Example output of listing the `.ssh` folder content: ```bash ls ~/.ssh/ ``` ``` config id_rsa id_rsa.pub known_hosts known_hosts.old ``` The `config` file allows you to store multiple SSH connections along with their individual parameters, in addition to standard values. Using the full potential of this file can become complex since it is most useful for experienced users managing multiple servers. Following is a simple example to explain how to configure an SSH connection to an instance. Open the file and add the following lines at the top: ``` Host instance HostName 203.0.113.100 IdentityFile ~/.ssh/myInstance_rsa ``` Be sure to use the correct IP address and key file name. The first line, beginning with `Host`, defines the name of this connection (`instance` in this example). You can then log in to the instance by replacing the instance IP address with the alias name identifying this connection as `Host`: ```bash ssh ubuntu@connection_name ``` Example output: ```bash ssh ubuntu@instance ``` Only the instance IP and the key file were specified in the previous example but more details can be added. To configure an SSH connection to a second remote host with the username "rocky", the modified SSH port "49160" and the private key in the file "myserver\_rsa", extend the file content as shown in this example: ``` Host instance HostName 203.0.113.100 IdentityFile ~/.ssh/myInstance_rsa Host myserver HostName 203.0.113.101 User rocky Port 49160 IdentityFile ~/.ssh/myserver_rsa ``` You can then connect to this server by entering: ```bash ssh myserver ``` Consult the [corresponding `man` page](https://manpages.org/ssh_config/5) for more information about the `config` file. #### How to configure key pairs from a Windows device Open the.Command Prompt by typing `cmd` into the search bar (or open PowerShell from the "Start" menu). Open the `.ssh` directory for your active Windows user (default path: `C:\Users\WindowsUsername\.ssh`): ```bash cd .ssh ``` Use the command `ssh-keygen` to create a key pair. The option `-t` allows you to specify the encryption method. **Note:** `Ed25519` is considered the most secure but `RSA` is a valid alternative. Both methods are compatible with the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/). Examples: ```bash ssh-keygen -t ed25519 -a 100 ``` ```bash ssh-keygen -t rsa -b 4096 -a 100 ``` The next prompt allows you to name the newly created key or use the standard file name: ``` Generating public/private rsa key pair. Enter file in which to save the key (/home/user/.ssh/id_rsa): ``` If you confirm with `Enter` without entering a name, the standard file name will be used (`id_rsa` in this example). If you plan to use more than one key pair in the future, enter an individual file name to identify the key. You can find more information about this below in the **Managing multiple authentication keys on your local device section**.\ This example outputs below will keep using the standard file names `id_rsa` and `id_rsa.pub` for illustration purposes. You can protect your SSH key with a passphrase at the next prompt. This is recommended for added security. **Warning:** **NOTE:** Remote access to your instance is only as secure as the client device storing the private key. Protecting your device and files from unauthorized access is therefore crucial when using SSH keys. For increased convenience and security, store passphrases in a password manager on your device, such as the open-source solution `KeePass`. All SSH keys should be stored in the `.ssh` directory. The public key files will have `.pub` added to the filename. ``` Your identification has been saved in id_rsa. Your public key has been saved in id_rsa.pub. The key fingerprint is: SHA256:MRk+Y0zCOoOkferhkTvMpcMsYspj212lK7sEauNap user@hostname The key's randomart image is: +---[RSA 4096]----+ | .. o | | . .= o | | o o X | |. . . . | |. .=.o .S. | | =o.o. . . | |o + . . o .. | |.. . . oEoo . | |o. .o+oo | +----[SHA256]-----+ ``` You can open the key file with a text editor (Notepad, Notepad++, etc.). From teh Windows File Explorer, right-click on the file and select `Open with`. You can also use one of the following commands (when in the `\Users\WindowsUsername\.ssh` directory): - `cmd` ```bash more id_rsa.pub ``` - `powershell` ```bash cat id_rsa.pub ``` Copy this key string to [add it to a new instance](https://docs.us.ovhcloud.com/en/public-cloud/compute/getting-started.md#step-4-create-the-instance) or to [import it into the OVHcloud Control Panel](https://docs.us.ovhcloud.com/en/public-cloud/compute/getting-started.md#step-2-import-ssh-keys). **Note:** **Clipboard usage** When working from a **Windows** command line, you can use a right-click to **paste** the content of your clipboard into the command line window. To **copy** a string from the command line window, highlight it, then press `Enter`. You can also find these functions via a right-click on the menu bar of the command line window.   **Managing multiple authentication keys on your local device** You might want to use multiple SSH key pairs to connect to different remote hosts or local networks. Since all keys should be placed in the `.ssh` folder on your Windows user directory, the file names have to be different. When you create a new key pair and you are asked to provide a file name, enter a name of your choice, for example the name of your instance. Output example: ``` Generating public/private rsa key pair. Enter file in which to save the key (C:\Users\Username/.ssh/id_rsa): KeyFileName_rsa Your identification has been saved in KeyFileName_rsa. Your public key has been saved in KeyFileName_rsa.pub. ``` When connecting to the corresponding instance, specify the name of the private key file in addition to the connecting user and server details: ```bash ssh -i C:\Users\Username\.ssh/KeyFileName user@IP_ADDRESS ``` Example: ```bash ssh -i C:\Users\Username\.ssh/myInstance_rsa ubuntu@203.0.113.100 ```   _Using the "config" file_ The alternative to adding the option `-i` each time is to edit a file named `config` inside the folder `C:\Users\Username\.ssh`. You can use it to configure details for different connections (username, port, key file, optional parameters, etc.) If this file exists inside `.ssh`, it probably contains some information already. Depending on your working environment, consider creating a backup copy of the original first. Example of `.ssh` folder content: ```bash C:\Users\Username\.ssh>dir /B ``` ``` config id_rsa id_rsa.pub known_hosts known_hosts.old ``` The `config` file allows you to store multiple SSH connections along with their individual parameters, in addition to standard values. Using the full potential of this file can become complex since it is most useful for experienced users managing multiple servers regularly. Following is a simple example to explain how to configure an SSH connection to an instance.\ Open the file and add the following lines at the top: ``` Host instance HostName 203.0.113.100 IdentityFile ~/.ssh/myInstance_rsa ``` Be sure to use the correct IP address and key file name. The first line, beginning with `Host`, defines the name of this connection (`instance` in this example). You can then log in to the instance by replacing the instance IP address with the alias name identifying this connection (`Host`): ```bash ssh username@connection_name ``` Example: ```bash ssh ubuntu@instance ``` Only the instance IP and the private key file were specified in the previous example but more details can be added. To configure an SSH connection to a second remote host with the username "rocky", the modified SSH port "49160" and the private key in the file "myserver\_rsa", extend the file content as shown in this example: ``` Host instance HostName 203.0.113.100 IdentityFile C:\Users\Username\.ssh/myInstance_rsa Host myserver HostName 203.0.113.101 User rocky Port 49160 IdentityFile C:\Users\Username\.ssh/myserver_rsa ``` You can then connect to this second host by entering: ```bash ssh myserver ``` Consult the [corresponding `man` page](https://manpages.org/ssh_config/5) for more information about the `config` file.   ### Adding additional public keys to a running instance To add SSH keys for other users accessing your instance, repeat the key creation steps but use the appropriate `$HOME` folder or Windows `Users` directory of the user in question to create and store the SSH keys (or execute the commands on this person's dedicated device). Use our [dedicated guide](https://docs.us.ovhcloud.com/en/public-cloud/compute/configuring-additional-ssh-keys.md) for a detailed explanation of these steps.   ## Go further - [Creating and Connecting a Public Cloud instance](https://docs.us.ovhcloud.com/en/public-cloud/compute/getting-started.md) - [Getting Started with SSH](https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/ssh-introduction.md) - [How to Configure Additional SSH Keys](https://docs.us.ovhcloud.com/en/public-cloud/compute/configuring-additional-ssh-keys.md) Browse all the [Compute guides](https://docs.us.ovhcloud.com/en/public-cloud/compute/landing-page-compute.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Public Cloud Compute](https://us.ovhcloud.com/public-cloud/compute/) on the OVHcloud US website. If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://us.ovhcloud.com/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.