SSH keys

Make a key pair

Make the key on your own computer, not on a server. The private half stays there, and only the public half goes to the project. An Ed25519 key is short and quick for a server to check.

$ ssh-keygen -t ed25519 -C "you@acme-shop"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/you/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):

Set a passphrase, and let ssh-agent hold the key so you type it once a session. The public key is the file whose name ends in .pub.

A key you already use for other servers works here too, so add the same public key.

Add the key to a project

Keys belong to a project, and everyone in the project can choose them when they create a server.

In the console

1. Open the project and choose SSH keys.
2. Choose Add key and paste the contents of ~/.ssh/id_ed25519.pub.
3. Give the key a short name, such as me, and save it.

With lc

$ lc ssh-key add me --file ~/.ssh/id_ed25519.pub
$ lc ssh-key list
NAME  TYPE     FINGERPRINT
me    ED25519  SHA256:q3Rk...v0Yc

Use the key on a server

Name the key when you create a server, and repeat the flag for each further key.

$ lc server create web-1 --plan s-2 --region ee1 \
    --image debian-13 --ssh-key me --ssh-key ci
$ ssh root@203.0.113.24

cloud-init writes the keys to /root/.ssh/authorized_keys at first boot. It runs once, so a key you add to the project later does not reach servers that already exist.

Add a key to a running server

From a machine that can already log in, append the other person’s public key to the file:

$ ssh root@203.0.113.24 'cat >> ~/.ssh/authorized_keys' < ana.pub

Keys for a team

Each person adds their own key under their own name, such as ana or jonas. Don’t share one private key between people, as you can’t take it back from one of them.

For CI, make a separate key without a passphrase and keep it in the CI system’s secret store. Add it under a name like ci, so it is clear where it lives.

When someone leaves the team, remove their key from the project. Then remove their line from authorized_keys on each server, or replace the servers.

Removing a key from a project does not remove it from servers. The project’s list only decides which keys go onto servers at first boot.

When a key is lost

Without the private key SSH stays closed, but the server’s serial terminal in the console still works:

1. Open the server in the console and choose Console.
2. Choose Reset root password and copy the password it shows.
3. Log in at the terminal and add your public key to /root/.ssh/authorized_keys.
4. Log in over SSH with the key, then set a fresh root password or lock it with passwd -l root.

The password reset restarts the server, so plan it for a quiet hour.