Manage SSH key pairs
Create or import SSH key pairs, use them when you create virtual machines, download their public keys, and delete the ones you no longer need.
An SSH key pair lets you sign in to Linux instances without a password. When you create an instance, the platform installs the public keys of the key pairs that you select on the instance's first boot.
Key pairs belong to a project and are listed under ComputeKey pairs. A key pair's name must be unique across all projects of your tenant in the region, so two projects can't use the same key pair name.
Before you begin
- To create, import, or delete key pairs, you need the Owner or Contributor role, or a custom role with Manage access to Compute / Instances, on the subscription or on the project.
- To import a key, you need an OpenSSH public key that starts with
ssh-ed25519,ssh-rsa, orecdsa-sha2-nistp256.
Create a key pair
The platform generates an Ed25519 key pair. The console shows the private key only once. Download it then.
In the console, go to ComputeKey pairs.
Select Create key pair.
In Key pair name, enter a name: up to 63 lowercase letters, numbers, and hyphens, starting with a letter or a number.
Under How do you want to provide the key?, keep Generate new, and select Generate key pair.
Select Download .pem, and store the file in a safe place.
Select Done.
Important
The console shows the private key only once. Download it then. You can't download the private key again from the console. If you lose it, create a new key pair.
Import a public key
Import a key when you already have a key pair on your computer. Only the public key is uploaded; your private key never leaves your machine.
In the console, go to ComputeKey pairs, and select Import key.
In Key pair name, enter a name.
In Public key, paste your public key, and select Import key pair.
For example, to create a key on your computer with OpenSSH and print its public key for pasting:
ssh-keygen -t ed25519 -f ~/.ssh/<key-name>
cat ~/.ssh/<key-name>.pubReplace <key-name> with a file name for the key.
Create a key pair while you create an instance
You don't have to leave the creation wizard. On the Basics step, select New SSH key pair. The dialog generates or imports a key pair in the project and selects it for the instance; what you entered in the wizard is kept.
Use key pairs with an instance
On the Basics step of the creation wizard, select one or more key pairs, up to 10 per instance. Each selected public key is installed for the image's default user, such as ubuntu, and, if you also set an administrator password, for the administrator account. You can sign in with any of the selected keys.
The instance's Overview tab lists its key pairs under Key pair. To sign in, see Connect to a virtual machine.
The keys are installed only on the first boot, through cloud-init. You can't add or remove key pairs on an existing instance through the console or the API. To change who can sign in, edit the authorized keys inside the instance's operating system, or create a new instance with the key pairs you want.
View a key pair and download its public key
In the console, go to ComputeKey pairs, and select the key pair.
Select Download public key. The browser saves the public key as a .pub file.
The key pair's page also shows its Algorithm, Key size, Fingerprint in the OpenSSH SHA256 format, and the number of instances that use it.
Delete a key pair
You can't delete a key pair while any instance in the project was created with it. Because an instance's keys can't be changed, delete those instances first, or keep the key pair.
In the console, go to ComputeKey pairs, and select the key pair.
Select Delete.
In the confirmation, select Delete.
Deleting a key pair can't be undone.