Skip to content

How-to

Key pairs

Make an SSH key pair on your computer, add its public key to Breqwatr Cloud, and pick it when you launch a Linux instance. You sign in to the instance with the private key.

The private key never leaves your computer. Breqwatr Cloud holds only the public key, and puts it on a Linux instance when the instance first boots. Windows instances don't use key pairs: you set the Administrator password on the console instead, as in Connect to an instance.

Before you start

  • An OpenSSH client. It's built into Windows 10 and later, macOS and Linux.

Make a key pair

In PowerShell:

mkdir -Force $HOME\.ssh
ssh-keygen -t ed25519 -f $HOME\.ssh\web-key

mkdir -p ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/web-key

ssh-keygen asks for a passphrase, which protects the private key if someone copies it. This makes web-key, the private key, and web-key.pub, the public key, in the .ssh folder in your home folder. Use -t rsa -b 4096 instead of -t ed25519 only if a tool you use needs RSA.

Add the public key

  1. In the Breqwatr Cloud Portal (Strata), open your account menu at the top right and choose My Account.
  2. In SSH Keys, choose Add key.
  3. Enter a Name, such as web-key. Names use letters, numbers, spaces, - and _.
  4. Paste the whole of web-key.pub into Public key: one line that starts with ssh-ed25519 or ssh-rsa. Choose Add key.

The Add SSH key dialog on the profile page, with a name and an ssh-ed25519 public key pasted into Public key

The key belongs to your account, so it's available in every project you can work in. It shows Syncing for a few seconds while the portal adds it to each project.

openstack --os-cloud <cloud-name> keypair create --public-key ~/.ssh/web-key.pub web-key

In PowerShell, the path is $HOME\.ssh\web-key.pub.

The key pair belongs to your user, so it works in every project you can work in. The portal's launch form lists the keys on your My Account page: to add a key pair made with the CLI there, choose Resync from cloud in SSH Keys.

resource "openstack_compute_keypair_v2" "web" {
  name       = "web-key"
  public_key = file(pathexpand("~/.ssh/web-key.pub"))
}

Use it in an instance with key_pair = openstack_compute_keypair_v2.web.name.

Launch with the key

Pick the key when you launch a Linux instance: SSH Key on the portal's launch form, --key-name web-key with openstack server create, or key_pair in OpenTofu. The image's default user then accepts it: see Connect to an instance.

An instance keeps the key it was launched with. Adding, changing or deleting a key pair later doesn't change instances that are already running.

Check it worked

  • The key is listed in SSH Keys on My Account, or by openstack --os-cloud <cloud-name> keypair list.

  • Its fingerprint matches your public key's. My Account shows the SHA256 form, which ssh-keygen -l -f ~/.ssh/web-key.pub prints. The CLI shows the MD5 form, which ssh-keygen prints with -E md5:

    openstack --os-cloud <cloud-name> keypair show web-key -c fingerprint
ssh-keygen -l -E md5 -f ~/.ssh/web-key.pub

Delete a key

In SSH Keys on My Account, choose Delete on the key's row, type CONFIRM and choose Delete key. The key is removed from every project.

openstack --os-cloud <cloud-name> keypair delete web-key

Remove the resource and apply.

Instances launched with the key still accept it. To stop a key working on an instance, remove its line from ~/.ssh/authorized_keys on the instance.