Getting started with SSH keys

Supported SSH key types: RSA and ED25519 in the UI

IBM Cloud® Virtual Private Cloud supports two different types of public SSH keys.

• RSA
• ED25519

On IBM Cloud VPC, RSA is the default SSH key type. You can select to change the key type to ED25519. The ED25519 SSH key type enables a slightly higher performance benefit because it can give the same level of security as the RSA SSH key type with a smaller key. You can create virtual server instances and bare metal servers with a mix of RSA and ED25519 SSH keys.

In the IBM Cloud console, you can go to Navigation menu icon > Infrastructure > Compute > SSH keys to manage your SSH keys. From here you can create, rename, or delete keys. If you select to create a key, that key must be an RSA SSH key type. You can upload an ED25519 SSH key type, you just can't generate one within VPC.

You can generate RSA key pairs in the console. Pre-existing RSA and ED25519 SSH keys can be uploaded. ED25519 can be used only if the operating system supports this key type. ED25519 can't be used with Windows or VMware images.

You can generate RSA key pairs in the console. Pre-existing RSA and ED25519 SSH keys can be uploaded.

SSH key types: RSA and ED25519 in the CLI

IBM Cloud® Virtual Private Cloud supports two different types of public SSH keys.

• RSA
• ED25519

On IBM Cloud VPC, RSA is the default SSH key type. You can select to change the key type to ED25519. The ED25519 SSH key type enables a slightly higher performance benefit because it can give the same level of security as the RSA SSH key type with a smaller key. You can create virtual server instances and bare metal servers with a mix of RSA and ED25519 SSH keys.

• For Windows or VMware images, you must use the RSA SSH key type. The ED25519 SSH key type can't be used with Windows or VMware images.
• For Linux images, the ED25519 SSH key type can be used only if the SSH server for the operating system supports that key type.

In the CLI, you can specify which type of key by using the --key-type option. You can't create SSH keys within the CLI, you can import only an existing SSH key. The default --key-type is RSA. If you try to import an ED25519 SSH key and don't specify the ed25519 key type, the process fails.

--key-type ed25519

SSH key types: RSA and ED25519 in the API

IBM Cloud® Virtual Private Cloud supports two different types of public SSH keys.

• RSA
• ED25519

On IBM Cloud VPC, RSA is the default SSH key type. You can select to change the key type to ED25519. The ED25519 SSH key type enables a slightly higher performance benefit because it can give the same level of security as the RSA SSH key type with a smaller key. You can create virtual server instances and bare metal servers with a mix of RSA and ED25519 SSH keys.

• For Windows or VMware images, you must use the RSA SSH key type. The ED25519 SSH key type can't be used with Windows or VMware images.
• For Linux images, the ED25519 SSH key type can be used only if the SSH server for the operating system supports that key type.

You can't create SSH keys within the API, you can import only an existing SSH key. You can generate a new RSA SSH key pair within the UI. You have the option when you create an SSH key to copy the API code snippet for that key.

In the API, you can specify which type of key by using the type variable. The default type is RSA. If you try to import an ED25519 SSH key and don't specify the ed25519 key type, the process fails.

"type":"ed25519"

SSH key types: RSA and ED25519 in the Terraform

IBM Cloud® Virtual Private Cloud supports two different types of public SSH keys.

• RSA
• ED25519

On IBM Cloud VPC, RSA is the default SSH key type. You can select to change the key type to ED25519. The ED25519 SSH key type enables a slightly higher performance benefit because it can give the same level of security as the RSA SSH key type with a smaller key. You can create virtual server instances and bare metal servers with a mix of RSA and ED25519 SSH keys.

• For Windows or VMware images, you must use the RSA SSH key type. The ED25519 SSH key type can't be used with Windows or VMware images.
• For Linux images, the ED25519 SSH key type can be used only if the SSH server for the operating system supports that key type.

You can't create SSH keys within Terraform, you can import only an existing SSH key. You can generate a new RSA SSH key pair within the UI.

In Terraform, you can specify which type of key by using the type variable. The default type is rsa. If you try to import the ED25519 SSH key and don't specify the ed25519 key type, the process fails.

type = "ed25519"

Locating your existing SSH keys in the console

1. In IBM Cloud console, go to Navigation menu icon > Infrastructure > Compute > SSH keys.
2. Any existing SSH keys are displayed.

Listing your existing SSH keys from the CLI

To view a list of all SSH keys by using the CLI, use the ibmcloud is keys command. Specify either the RESOURCE_GROUP_ID or RESOURCE_GROUP_NAME variable. If you want to list all your resource groups, specify --all-resource-groups.

ibmcloud is keys [--all-resource-groups]

For more information, see the ibmcloud is keys in the VPC CLI reference.

Listing your existing SSH keys with the API

To list all SSH keys by using the API, use List all keys.

curl -X GET "$vpc_api_endpoint/v1/keys?version=2023-03-30&generation=2" -H "Authorization: Bearer $iam_token"

Listing your existing SSH keys by using Terraform

To list all SSH keys by using Terraform, use ibm_is_ssh_keys.

data "ibm_is_ssh_keys" keys {}

Creating your SSH key in the console

Use the following steps to create an SSH key. You can create only an RSA SSH key. For ED25519 SSH keys, you must upload the SSH key.

1. In IBM Cloud console, go to Navigation menu icon > Infrastructure > Compute > SSH keys.

2. Click Create and enter the information that is in Table 1.

   Creating an SSH key for VPC selections

   Field	Value
   Location	Locations are composed of regions (specific geographic areas) and zones (fault-tolerant data centers within a region). Select the location where you want to create your SSH key.
   Name	A name is required for your SSH key.
   Resource group	Select a resource group for the SSH key.
   Tags	You can assign a user tag to the SSH key so that you can easily filter a list of SSH keys. For more information, see Working with tags.
   Access management tags	Access management tags help you apply flexible access policies on specific resources. For more information, see the Controlling access to resources by using tags UI tutorial.
   SSH key type	The default value is rsa. You can generate new RSA key pairs in the UI. Pre-existing RSA and ED25519 SSH keys can be uploaded. ED25519 can be used only if the operating system supports this key type. ED25519 can't be used with Windows or VMware images.

3. Select Generate a key pair for me.

4. Optionally, click Get sample API call to get an API code with all your SSH key information that you can copy.

5. Click Create.

Your SSH key is now displayed in the list of SSH keys on the UI.

Importing an SSH key in the console

You can import an SSH key in two ways. You can upload a public key from a local file. Or you can paste in your public key into the UI.

Use the following steps to import an SSH key from a local file.

1. In IBM Cloud console, go to Navigation menu icon > Infrastructure > Compute > SSH keys.

2. Click Create and enter the information that is in Table 1.

   Creating an SSH key for VPC selections

   Field	Value
   Location	Locations are composed of regions (specific geographic areas) and zones (fault-tolerant data centers within a region). Select the location where you want to create your SSH key.
   Name	A name is required for your SSH key.
   Resource group	Select a resource group for the SSH key.
   Tags	You can assign a user tag to the SSH key so that you can easily filter a list of SSH keys. For more information, see Working with tags.
   Access management tags	Access management tags help you apply flexible access policies on specific resources. For more information, see the Controlling access to resources by using tags UI tutorial.

3. Select Provide existing public key.

4. Click Upload public key.

5. Select the public key file and click Open. The file extension, .pub, typically indicates which file contains the public key.

6. Optionally, click Get sample API call to get an API code with all your SSH key information that you can copy.

7. Click Create.

Use the following steps to import an SSH key by pasting in the public key material into the UI.

If you copy an SSH key from a terminal to add the key to your VPC, sometimes extra line breaks are introduced which cause a parsing error. To avoid this issue, first paste your SSH key into a text editor and remove any extra line breaks. Then, copy the SSH key from text editor and paste it into the VPC UI, CLI, or API.

Your imported SSH key is now displayed in the list of SSH keys on the UI.

Importing your SSH key by using the CLI

To import an SSH key by using the CLI, use the ibmcloud is key-create command. You must also specify a KEY_NAME and the KEY. The SSH key file is either the id_rsa.pub or id_ed25519.pub depending on which key type you are importing. Optionally, you can specify the resource by using either the RESOURCE_GROUP_ID or RESOURCE_GROUP_NAME variable. For more information, see the ibmcloud is key-create in the VPC CLI reference guide.

ibmcloud is key-create KEY_NAME (KEY | @KEY_FILE) [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME]

Importing your SSH key by using the API

To import an SSH key by using the API, use the Create a key. You can't create an SSH key by using the API. However, you can create an SSH key in the console and from the UI, generate the API code snippet that you need that includes the new SSH key. If you use the UI, make sure you save the SSH key that you create in the UI before you generate the API code snippet.

For the name property, specify the name of the SSH key. For public_key property, enter in the public key information. For the type property, specify either rsa or ed25519 for the SSH key type.

curl -X POST "$vpc_api_endpoint/v1/keys?version=2023-03-30&generation=2" -H "Authorization: Bearer $iam_token" -d '{
      "name":"my-key-1",
      "public_key":"AAAAB3NzaC1yc2EAAAADAQABAAABAQDDGe50Bxa5T5NDddrrtbx2Y4/VGbiCgXqnBsYToIUKoFSHTQl5IX3PasGnneKanhcLwWz5M5MoCRvhxTp66NKzIfAz7r+FX9rxgR+ZgcM253YAqOVeIpOU408simDZKriTlN8kYsXL7P34tsWuAJf4MgZtJAQxous/2byetpdCv8ddnT4X3ltOg9w+LqSCPYfNivqH00Eh7S1Ldz7I8aw5WOp5a+sQFP/RbwfpwHp+ny7DfeIOokcuI42tJkoBn7UsLTVpCSmXr2EDRlSWe/1M/iHNRBzaT3CK0+SwZWd2AEjePxSnWKNGIEUJDlUYp7hKhiQcgT5ZAnWU121oc5En",
      "type":"rsa"
    }'

Importing your SSH key by using Terraform

Create a ssh-key resource or use an existing ssh-key by referring to the ssh-key data source. For more information, see the Terraform documentation on ibm_is_ssh_keys

Create a ssh-key resource or use an existing ssh-key by referring to the ssh-key data source. For the name property, specify the name of the SSH key. For public_key property, enter in the public key information. For the type property, specify either rsa or ed25519 for the SSH key type. The default value is rsa. You must specify ed25519 to import an ed25519 SSH key.

resource "ibm_is_ssh_key" "example_sshkey" {
   name       = "example-sshkey"
   public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCKVmnMOlHKcZK8tpt3MP1lqOLAcqcJzhsvJcjscgVERRN7/9484SOBJ3HSKxxNG5JN8owAjy5f9yYwcUg+JaUVuytn5Pv3aeYROHGGg+5G346xaq3DAwX6Y5ykr2fvjObgncQBnuU5KHWCECO/4h8uWuwh/kfniXPVjFToc+gnkqA+3RKpAecZhFXwfalQ9mMuYGFxn+fwn8cYEApsJbsEmb0iJwPiZ5hjFC8wREuiTlhPHDgkBLOiycd20op2nXzDbHfCHInquEe/gYxEitALONxm0swBOwJZwlTDOB7C6y2dzlrtxr1L59m7pCkWI4EtTRLvleehBoj3u7jB4usR"
   type = "rsa"
}