SSH Access to VPS

Complete guide to connecting to your VPS instances via SSH (Secure Shell).

What is SSH?

SSH (Secure Shell) is a secure protocol for connecting to remote servers. It provides:

Encrypted connections
Secure authentication
Remote command execution
File transfer capabilities

Prerequisites

Before connecting:

✅ VPS instance is running
✅ SSH key is added to the instance
✅ Firewall allows port 22
✅ You have the public IP address

SSH Keys vs Passwords

SSH Keys (Recommended)

Advantages:

More secure than passwords
Cannot be brute-forced
Convenient (no typing)
Can be revoked easily

Passwords

Disadvantages:

Less secure
Can be brute-forced
Easy to forget
Harder to manage

We strongly recommend SSH keys!

Choosing at Create Time

When you create a VPS you pick one authentication method:

SSH key (recommended) — passwordless, key-based login
Root password — a password of at least 12 characters

Windows Server instances always use a password (access is over RDP). Whichever you choose, you can further harden authentication from inside the OS once connected — see SSH Security.

Generating SSH Keys

On Linux/Mac

Bash

# Generate ED25519 key (recommended)
ssh-keygen -t ed25519 -C "your_email@example.com"

# Or RSA key (if ED25519 not supported)
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

# Follow prompts:
# - Save location: Press Enter for default (~/.ssh/id_ed25519)
# - Passphrase: Optional but recommended for extra security

View your public key:

Bash

cat ~/.ssh/id_ed25519.pub

On Windows

Using PowerShell:

powershell

# Generate key
ssh-keygen -t ed25519 -C "your_email@example.com"

# View public key
type $env:USERPROFILE\.ssh\id_ed25519.pub

Using PuTTYgen:

Download PuTTYgen from putty.org
Click Generate
Move mouse for randomness
Add passphrase (optional)
Save private key
Copy public key text

Key Components

Private Key (id_ed25519):

Keep secret!
Never share
Never commit to git
Store securely

Public Key (id_ed25519.pub):

Safe to share
Add to servers
Add to DanubeData dashboard

Adding SSH Keys to DanubeData

Method 1: During VPS Creation

Create VPS instance
In SSH Keys section, click Add SSH Key
Paste your public key
Name it (e.g., "My Laptop")
Save the key, then confirm it's you when asked
Complete VPS creation

New servers accept every SSH key on your account for sign-in, so adding one asks you to confirm it's you, and we email you whenever a key is added.

Method 2: Add to Existing Instance

Go to Profile > SSH Keys
Click Add SSH Key
Paste public key
Name it
Click Add, then confirm it's you when asked
Attach to instances as needed

Public Key Format

Your public key should look like:

Text

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqfBqGqv9Q... your_email@example.com

Or for RSA:

Text

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZk8... your_email@example.com

When you add a key, DanubeData validates the format and flags duplicates, so you won't accidentally add the same key twice.

Connecting via SSH

Basic Connection

Bash

ssh root@YOUR_VPS_IP

First Connection:

You'll see host fingerprint
Type yes to confirm
Connection established!

With Custom Key

Bash

ssh -i ~/.ssh/my_custom_key root@YOUR_VPS_IP

With Custom Port

Bash

ssh -p 2222 root@YOUR_VPS_IP

With Username

Bash

ssh username@YOUR_VPS_IP

SSH Config File

Simplify connections with SSH config:

Create Config

Bash

nano ~/.ssh/config

Add Hosts

Text

# Production Server
Host prod-web
    HostName 192.0.2.10
    User root
    IdentityFile ~/.ssh/id_ed25519
    Port 22

# Staging Server
Host staging
    HostName 192.0.2.20
    User deploy
    IdentityFile ~/.ssh/id_rsa
    
# Development Server
Host dev
    HostName 192.0.2.30
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519

Connect Using Alias

Bash

# Instead of: ssh root@192.0.2.10
ssh prod-web

# Instead of: ssh deploy@192.0.2.20
ssh staging

Much easier!

SSH on Windows

Option 1: PowerShell (Windows 10+)

SSH is built into Windows 10/11:

powershell

ssh root@YOUR_VPS_IP

Option 2: PuTTY

Download PuTTY
Open PuTTY
Enter hostname/IP
Port: 22
Connection type: SSH
Click Open

Using SSH Key with PuTTY:

Convert key using PuTTYgen (Load private key → Save as .ppk)
In PuTTY: Connection → SSH → Auth → Browse for private key
Connect

Option 3: Windows Subsystem for Linux (WSL)

Bash

# Install WSL
wsl --install

# Use Linux SSH
ssh root@YOUR_VPS_IP

SSH Agent

SSH Agent stores your keys in memory:

Start SSH Agent

Bash

# Start agent
eval "$(ssh-agent -s)"

# Add key
ssh-add ~/.ssh/id_ed25519

# List keys
ssh-add -l

# Remove keys
ssh-add -D

Agent Forwarding

Use your local keys on remote server:

Bash

ssh -A root@YOUR_VPS_IP

Or in ~/.ssh/config:

Text

Host prod-web
    ForwardAgent yes

Warning: Only use on trusted servers!

File Transfer with SSH

SCP (Secure Copy)

Upload file:

Bash

scp local-file.txt root@YOUR_VPS_IP:/path/to/destination/

Download file:

Bash

scp root@YOUR_VPS_IP:/path/to/file.txt ./local-directory/

Copy directory:

Bash

scp -r local-directory/ root@YOUR_VPS_IP:/path/to/destination/

SFTP (SSH File Transfer Protocol)

Interactive session:

Bash

sftp root@YOUR_VPS_IP

# SFTP commands:
put local-file.txt          # Upload
get remote-file.txt         # Download
ls                          # List remote files
lls                         # List local files
cd /path                    # Change remote directory
lcd /path                   # Change local directory
quit                        # Exit

Rsync over SSH

Best for syncing directories:

Bash

# Sync local to remote
rsync -avz -e ssh ./local/ root@YOUR_VPS_IP:/remote/

# Sync remote to local
rsync -avz -e ssh root@YOUR_VPS_IP:/remote/ ./local/

# Options:
# -a: archive mode
# -v: verbose
# -z: compress
# -e ssh: use SSH

SSH Tunneling

Local Port Forwarding

Access remote service on local machine:

Bash

# Forward remote MySQL to local port 3306
ssh -L 3306:localhost:3306 root@YOUR_VPS_IP

# Now connect locally:
mysql -h 127.0.0.1 -P 3306

Remote Port Forwarding

Expose local service to remote server:

Bash

# Forward local service to remote
ssh -R 8080:localhost:3000 root@YOUR_VPS_IP

SOCKS Proxy

Route traffic through SSH:

Bash

ssh -D 8080 root@YOUR_VPS_IP

# Configure browser to use SOCKS proxy: localhost:8080

SSH Security

Edit a drop-in, not /etc/ssh/sshd_config. Your Pod ships with a platform drop-in at /etc/ssh/sshd_config.d/zz-danubedata.conf that sets PermitRootLogin, PasswordAuthentication, PubkeyAuthentication, ChallengeResponseAuthentication and AllowUsers, among others. /etc/ssh/sshd_config includes the drop-in directory as its first instruction and sshd keeps the first value it obtains for each keyword, so edits made further down the main file have no effect on those settings.
Put your settings in your own drop-in that sorts before ours — any name starting with a digit works, for example /etc/ssh/sshd_config.d/10-hardening.conf. Don't edit zz-danubedata.conf directly: it is rewritten from our template when a Pod is reinstalled.
After editing, run sudo sshd -t to check the syntax and sudo sshd -T | grep -E 'permitrootlogin|allowusers|passwordauthentication' to confirm the effective values, then restart. Keep your current session open until a fresh login works.

Bash

# Edit your own drop-in
sudo nano /etc/ssh/sshd_config.d/10-hardening.conf

# Change to:
PermitRootLogin no

# Verify and restart SSH
sudo sshd -t && sudo systemctl restart sshd

Disable Password Authentication

Bash

# Edit your own drop-in
sudo nano /etc/ssh/sshd_config.d/10-hardening.conf

# Change to:
PasswordAuthentication no
PubkeyAuthentication yes

# Verify and restart SSH
sudo sshd -t && sudo systemctl restart sshd

Change SSH Port

Bash

# Edit your own drop-in
sudo nano /etc/ssh/sshd_config.d/10-hardening.conf

# Change port:
Port 2222

# Restart SSH
sudo systemctl restart sshd

# Update firewall:
sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp

Limit SSH Access

By IP:

Bash

# UFW
sudo ufw allow from YOUR_IP to any port 22

# Or in your own drop-in, /etc/ssh/sshd_config.d/10-hardening.conf:
AllowUsers root@YOUR_IP

By user:

Bash

# /etc/ssh/sshd_config.d/10-hardening.conf:
AllowUsers john jane

Two-Factor Authentication

Add extra security layer:

Bash

# Install Google Authenticator
sudo apt install libpam-google-authenticator -y

# Configure for user
google-authenticator

# Edit PAM config
sudo nano /etc/pam.d/sshd
# Add: auth required pam_google_authenticator.so

# Edit your own drop-in
sudo nano /etc/ssh/sshd_config.d/10-hardening.conf
# Set: ChallengeResponseAuthentication yes

# Restart SSH
sudo systemctl restart sshd

Troubleshooting

Permission Denied

Check key is added:

Bash

ssh-add -l

Add key:

Bash

ssh-add ~/.ssh/id_ed25519

Verify key on server:

Bash

cat ~/.ssh/authorized_keys

Connection Timeout

Check firewall:

Verify firewall allows port 22
Check cloud firewall rules
Test with: telnet YOUR_VPS_IP 22

Check SSH service:

Bash

# Use web console
sudo systemctl status sshd
sudo systemctl start sshd

Host Key Verification Failed

Server key changed (reinstall or new server):

Bash

# Remove old key
ssh-keygen -R YOUR_VPS_IP

# Reconnect (will add new key)
ssh root@YOUR_VPS_IP

Too Many Authentication Failures

Specify key:

Bash

ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 root@YOUR_VPS_IP

Or in config:

Text

Host *
    IdentitiesOnly yes

Connection Drops

Keep alive:

Bash

# Add to ~/.ssh/config:
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3

On server (/etc/ssh/sshd_config):

Text

ClientAliveInterval 60
ClientAliveCountMax 3

SSH Best Practices

Key Management

Use ED25519 keys (modern, secure)
Use passphrase on private keys
One key per device
Rotate keys regularly
Remove old/unused keys

Connection Security

Disable password authentication
Disable root login
Use non-standard port
Limit access by IP
Use 2FA for critical servers

Daily Usage

Use SSH config file
Use SSH agent
Keep private keys secure
Never share private keys
Use different keys for different purposes

Monitoring

Review SSH logs: sudo tail -f /var/log/auth.log
Check failed attempts
Use fail2ban
Monitor unusual activity

Advanced SSH Tips

Jump Hosts (Bastion)

Connect through intermediate server:

Bash

ssh -J bastion@jump-host root@final-server

Or in config:

Text

Host final-server
    ProxyJump bastion@jump-host

SSH Multiplexing

Share connections:

Text

Host *
    ControlMaster auto
    ControlPath ~/.ssh/control-%r@%h:%p
    ControlPersist 10m

Benefits:

Faster subsequent connections
Less overhead
Shared authentication

SSH Escape Sequences

During SSH session:

~. - Disconnect
~^Z - Suspend SSH
~# - List forwarded connections
~? - Help

Remote Command Execution

Run command without interactive session:

Bash

# Single command
ssh root@YOUR_VPS_IP 'uptime'

# Multiple commands
ssh root@YOUR_VPS_IP 'cd /var/www && ls -la'

# Script execution
ssh root@YOUR_VPS_IP 'bash -s' < local-script.sh

SSH Clients

Linux/Mac

OpenSSH: Built-in, most common
Termius: Modern GUI client
iTerm2 (Mac): Terminal with SSH features

Windows

OpenSSH: Built into Windows 10+
PuTTY: Popular, free
MobaXterm: Feature-rich
Termius: Modern, cross-platform
Windows Terminal: Modern terminal

Mobile

Termius: iOS/Android
JuiceSSH: Android
Blink Shell: iOS

Next Steps

Need help with SSH? Contact support through the dashboard.

SSH Access to VPS

What is SSH?

Prerequisites

SSH Keys vs Passwords

SSH Keys (Recommended)

Passwords

Choosing at Create Time

Generating SSH Keys

On Linux/Mac

On Windows

Key Components

Adding SSH Keys to DanubeData

Method 1: During VPS Creation

Method 2: Add to Existing Instance

Public Key Format

Connecting via SSH

Basic Connection

With Custom Key

With Custom Port

With Username

SSH Config File

Create Config

Add Hosts

Connect Using Alias

SSH on Windows

Option 1: PowerShell (Windows 10+)

Option 2: PuTTY

Option 3: Windows Subsystem for Linux (WSL)

SSH Agent

Start SSH Agent

Agent Forwarding

File Transfer with SSH

SCP (Secure Copy)

SFTP (SSH File Transfer Protocol)

Rsync over SSH

SSH Tunneling

Local Port Forwarding

Remote Port Forwarding

SOCKS Proxy

SSH Security

Disable Root Login

Disable Password Authentication

Change SSH Port

Limit SSH Access

Two-Factor Authentication

Troubleshooting

Permission Denied

Connection Timeout

Host Key Verification Failed

Too Many Authentication Failures

Connection Drops

SSH Best Practices

Key Management

Connection Security

Daily Usage

Monitoring

Advanced SSH Tips

Jump Hosts (Bastion)

SSH Multiplexing

SSH Escape Sequences

Remote Command Execution

SSH Clients

Linux/Mac

Windows

Mobile

Next Steps