SSH Keys

SSH keys are registered to a workspace and get copied to new instances. Everyone in the workspace can use them. Each key shows who uploaded it.

Adding a key

1. Head over to your workspace’s “SSH Keys” page, under “Security” in the sidebar
2. Hit “Upload SSH Key”
3. Give the key a name
4. Paste the public key
5. Hit “Save”

We accept one OpenSSH public key line of type Ed25519, RSA, ECDSA, or a hardware-backed sk- key.

Warning

PuTTY .ppk files and DSA keys do not work.

Tip

To create a key, see Using SSH Keys or Hardware Security Keys.

When keys reach an instance

When	What happens
Instance is created	It receives all of the workspace’s keys for root
Instance is reinstalled	It receives all of the workspace’s keys again
You add or delete a key	Existing servers do not change until you sync them

We install the keys through cloud-init. A custom template needs cloud-init to receive them.

Syncing keys to an existing server

1. Head over to the instance list and open your instance
2. Hit “Sync SSH Keys” in the “Advanced” menu
3. Hit “Confirm”

The server must be running and does not reboot. Sync works on Linux and BSD servers only and requires a working guest-agent on the instance.

Warning

Sync replaces the root user’s authorized keys with the workspace’s full key list. Any key you added on the server by hand is removed. Other users on the server keep their keys.

Removing access

Deleting a key from “SSH Keys” does not remove it from servers.

1. Head over to your workspace’s “SSH Keys” page, under “Security” in the sidebar
2. Delete the key
3. Sync each server that had it

Disabling password login

Before you turn it on, check that you can log in with a key. If you lock yourself out, use the Terminal tab.

1. Head over to your workspace’s “Settings” page in the sidebar
2. Under “Security”, turn on “Disable SSH password authentication on key sync”

New servers, reinstalls and every sync then turn off SSH password login for servers with keys.