Add SSH Keys

Below explains how to add a SSH key on the host server of an existing Storage Box. This also works in subaccounts.

Before you follow this how-to guide, open the overview of your Storage Box in Hetzner Console to check if SSH support is enabled. If you want to upload the SSH key via SSH and it is not enabled yet, select the action "Change settings" and enable SSH support now. After you activate SSH, it can take a few minutes before you can access your Storage Box via SSH.

Generating SSH keys

You can use ssh-keygen to generate a new pair of SSH keys. Run the command on the device from which you want to connect to the Storage Box.

local-device> ssh-keygen
Generating public/private ed25519 key pair.
Enter file in which to save the key (/root/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_ed25519
Your public key has been saved in /root/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:CXP3We+/Ho+zMWWDZrU3owpqQlie1NLfITUMCJJXEIg root@local-device
The key's randomart image is:
+--[ED25519 256]--+
|  ..o+=...o      |
| E o.. .   +     |
|    . = . o . .. |
|     + * + o oo..|
|    = o S o ++ ==|
|   . +   . .o .+=|
|    .    .   .o..|
|     . .. . . .++|
|      o.   .  +=+|
+----[SHA256]-----+

Warning: With the default settings, using ssh-keygen will overwrite an existing SSH key! As an alternative, with the parameter -f, you can specify a different file path.

Uploading the SSH key

On your local device, you should now see the private and the public key. To add the public key on the host server of your Storage Box, choose one of the following options:

Warning: Options 2 and 3 upload the key with scp, which overwrites the entire .ssh/authorized_keys file - this deletes any keys already stored there, including a key added when the Storage Box was created or a key in the other port's format. Each of these options sets up only a single port, so running one after the other will overwrite the first. To keep existing keys, or to use both port 22 and port 23, use Option 1 (install-ssh-key), which adds the key in both formats without removing existing keys.

Option 1: Via SSH

Run the following command to upload your public key to the host server of your Storage Box for both ports:
```
local-device> cat ~/.ssh/id_ed25519.pub | ssh -p23 uXXXXX@uXXXXX.your-storagebox.de install-ssh-key
uXXXXX@uXXXXX.your-storagebox.de's password:
Key No. 1 (ssh-ed25519 user@host) was installed in RFC4716 format
Key No. 1 (ssh-ed25519 user@host) was installed in OpenSSH format
```
You can now use the public SSH key to login without a password.

Option 2: Extended SSH Service on Port 23 (SFTP/rsync/BorgBackup)

Port 23 uses the one-line OpenSSH format of the public key.
- Upload with ssh-copy-id (OpenSSH 8.5+)
```
ssh-copy-id -p 23 -s uXXXXX@uXXXXX.your-storagebox.de
```
- Upload without ssh-copy-id (manually)
  
  If you have an older OpenSSH client software, you can also upload the public key manually:
```
ssh -p 23 uXXXXX@uXXXXX.your-storagebox.de mkdir .ssh
scp -P 23 .ssh/id_ed25519.pub uXXXXX@uXXXXX.your-storagebox.de:.ssh/authorized_keys
```
Option 3: SSH Service on Port 22 (SFTP)

For the SSH service on port 22, you must convert your public key into the RFC4716 format and then upload it.
- Converting your key to RFC4716 format
```
ssh-keygen -e -f .ssh/id_ed25519.pub > .ssh/id_ed25519_rfc.pub
```
  The public SSH key should now look like the one below:
```
cat .ssh/id_ed25519_rfc.pub
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "256-bit ED25519, converted by root@local-device"
AAAAC3NzaC1lZDI1NTE5AAAAIA+mKvwKjsBCweAMcDAQlLMnsH9L95iNyUks+Meb+pDa
---- END SSH2 PUBLIC KEY ----
```
- Upload
```
echo "mkdir .ssh" | sftp uXXXXX@uXXXXX.your-storagebox.de
scp .ssh/id_ed25519_rfc.pub uXXXXX@uXXXXX.your-storagebox.de:.ssh/authorized_keys
```

Testing the SSH key

Depending on which SSH key format you have uploaded, you should be able to log in without a password on port 22 and/or 23:
```
sftp -P <22 or 23> uXXXXX@uXXXXX.your-storagebox.de
Connected to uXXXXX.your-storagebox.de.
sftp> quit
```

Option 1: Via SSH

Option 2: Extended SSH Service on Port 23 (SFTP/rsync/BorgBackup)

Option 3: SSH Service on Port 22 (SFTP)