DHIVA LABS · LEARN

Appearance

Use SSH keys ​

Sign in with a key instead of a password: generate one in SecureShell Go and install it on your server, or import a key you already have.

Password or key? ​

With password sign-in, you type (or save) the account's password and the server checks it. It is quick to set up, but anyone who learns the password can sign in from anywhere, and servers on the internet see constant password-guessing attempts.

With key sign-in, you have a key pair: a private key that stays on your device, and a public key that you put on the server, in the file ~/.ssh/authorized_keys. When you connect, your device proves it holds the private key without ever sending it. A key cannot be guessed, and copying the public key gives nobody access.

Keys are the safer choice for any server you use regularly. Many server owners turn password sign-in off once keys work.

DANGER

Your private key is as good as a password to every server that trusts it. Never paste it into a chat, an email or a server, and never share the private half. Only the public line, the one starting with ssh-ed25519 or ssh-rsa, goes on servers.

Generate a key and install it ​

You need to be able to sign in with a password once, to install the key.

  1. Open the host's form: ⋮ › Edit, or + for a new host.

  2. Under the sign-in choice, select Private key.

  3. Tap Generate new key. SecureShell Go creates an ed25519 key pair.

    The New key generated dialog shows the public line, with a button to copy it. The private key now fills the Private key (PEM) field and will be saved with this host. Tap Done.

  4. Tap Save changes (or Save & connect for a new host) so the key is stored.

  5. Open the form again and tap Install public key on server….

  6. Enter the account's password when asked and tap Install. The app adds your public key to the server's authorized_keys file and shows Public key installed on the server.

  7. Connect. The server now accepts your key, and the password is not needed.

If you would rather add the key yourself, copy the public line from step 3 and append it to ~/.ssh/authorized_keys on the server.

Import an existing key ​

If you already have a private key, for example from ssh-keygen on a computer or a .pem file from a cloud provider such as AWS EC2:

  1. In the host's form, select Private key.

  2. Tap Import key file and choose the file. The app confirms with the file name and key type.

    You can also paste the key into Private key (PEM). Paste the whole key, including the BEGIN and END lines.

  3. If the key is encrypted, type its passphrase in Key passphrase (optional). The app says when an imported key needs one.

  4. Save the host.

SecureShell Go reads OpenSSH and PEM keys: RSA (including PKCS#1), ECDSA and ed25519. The key and passphrase are stored in your device's secure storage.

TIP

Get the key file onto your phone safely: a USB cable, or a file transfer you control. Avoid emailing a private key to yourself.

Sign in with your SSH agent (computers) ​

On Linux and Windows, the sign-in choice also offers OS SSH agent. Signing is done by your computer's agent (ssh-agent, Pageant or the Windows OpenSSH agent), security keys such as a YubiKey included. No password or key is saved for the host, and the private key never leaves the agent.

Certificates ​

If your organisation signs SSH keys with a certificate authority, you can load a -cert.pub file or paste a certificate in the host's sign-in settings. The app shows who and when the certificate is valid for, and warns when it is for a different key, has expired or is not valid yet.

Next steps ​