Stavane
  1. Documentation
  2. SSH keys and signing in to your server

SSH keys and signing in to your server

A Stavane server is built with one or both of two ways in: your public SSH key, or a root password we send you by e-mail as a one-time link. A key is the safer of the two: a password on a server on the open internet is tried by others within the hour, so choose a long one if you ever change it, or switch password login off once your key works.

No key? The root password by e-mail

In the order, E-mail me the root password is ticked by default. The server is then built with a random root password and with SSH login by password switched on. Once it runs, you get an e-mail with a link. The link opens on the console, after you sign in with the account that owns the server, and shows the password once. It works for 24 hours; after that, or once you have seen the password, it no longer works. The password itself is never in the e-mail and we do not keep it after you saw it.

Missed the link? Set a new password with Give root a new password.

Untick E-mail me the root password to build a server with SSH keys only: password login is then switched off, and you pick at least one key.

Add a key

  1. Open Access & security in the console, choose SSH keys and then Add.
  2. Give the key a name you will recognise later, for instance the laptop it belongs to. Left empty, we use the comment at the end of the key.
  3. Paste the public key. It is one line and starts with ssh-ed25519, ssh-rsa or ecdsa-sha2-.
  4. Choose Add key.

We only ever want the public half. The private half stays on your own machine; nobody at Stavane ever needs it, and support will never ask for it.

Make a key, if you have none

On macOS, Linux or Windows with OpenSSH, in a terminal:

ssh-keygen -t ed25519 -C "your@email"

Press enter for the default location and give a passphrase. The public key is then in ~/.ssh/id_ed25519.pub. Open that file and copy the single line it holds.

We install ssh-ed25519, ssh-rsa and the three ecdsa-sha2-nistp types, and we hold at most 25 keys per account.

Use it

When you configure a server you pick which of your keys go on it. You can pick more than one, for instance your laptop and your desktop. A server is never built without a key or the root password by e-mail: a machine nobody can reach is a machine you would have to throw away.

After the server is built:

ssh root@<the address of your server>

The keys go into the build itself, with root login allowed. Should your image use a default user of its own instead, sign in under that name (for example debian, ubuntu, almalinux, rocky or fedora) and use sudo.

Add a key to a server that already exists

A key you add later does not appear on servers that are already running: the key is written when the machine is built. There are two ways round that:

  • Sign in with a key that is already on the server and add the new one to /root/.ssh/authorized_keys yourself.
  • Or rebuild the server with the keys you want. That wipes everything on it.

Rename a key

Choose Rename next to the key under SSH keys, give the new name and choose Save name. Only the name you see changes; the key itself, and the servers that already have it, stay exactly as they are.

Remove a key

Removing a key under SSH keys removes it from your account, not from servers that were built with it. Remove it from authorized_keys on those servers as well, or rebuild them.