{"slug":"vps-ssh","title":"SSH Access to VPS","description":"Complete guide to connecting to your VPS instances via SSH (Secure Shell).","section":"Features","url":"https://docs.danubedata.ro/vps-ssh","markdown_url":"https://docs.danubedata.ro/vps-ssh.md","breadcrumbs":[{"title":"Features","slug":null},{"title":"VPS Instances","slug":"vps-overview"},{"title":"SSH Access","slug":"vps-ssh"}],"headings":[{"level":1,"title":"SSH Access to VPS","id":"ssh-access-to-vps"},{"level":2,"title":"What is SSH?","id":"what-is-ssh"},{"level":2,"title":"Prerequisites","id":"prerequisites"},{"level":2,"title":"SSH Keys vs Passwords","id":"ssh-keys-vs-passwords"},{"level":3,"title":"SSH Keys (Recommended)","id":"ssh-keys-recommended"},{"level":3,"title":"Passwords","id":"passwords"},{"level":3,"title":"Choosing at Create Time","id":"choosing-at-create-time"},{"level":2,"title":"Generating SSH Keys","id":"generating-ssh-keys"},{"level":3,"title":"On Linux/Mac","id":"on-linuxmac"},{"level":3,"title":"On Windows","id":"on-windows"},{"level":3,"title":"Key Components","id":"key-components"},{"level":2,"title":"Adding SSH Keys to DanubeData","id":"adding-ssh-keys-to-danubedata"},{"level":3,"title":"Method 1: During VPS Creation","id":"method-1-during-vps-creation"},{"level":3,"title":"Method 2: Add to Existing Instance","id":"method-2-add-to-existing-instance"},{"level":3,"title":"Public Key Format","id":"public-key-format"},{"level":2,"title":"Connecting via SSH","id":"connecting-via-ssh"},{"level":3,"title":"Basic Connection","id":"basic-connection"},{"level":3,"title":"With Custom Key","id":"with-custom-key"},{"level":3,"title":"With Custom Port","id":"with-custom-port"},{"level":3,"title":"With Username","id":"with-username"},{"level":2,"title":"SSH Config File","id":"ssh-config-file"},{"level":3,"title":"Create Config","id":"create-config"},{"level":3,"title":"Add Hosts","id":"add-hosts"},{"level":3,"title":"Connect Using Alias","id":"connect-using-alias"},{"level":2,"title":"SSH on Windows","id":"ssh-on-windows"},{"level":3,"title":"Option 1: PowerShell (Windows 10+)","id":"option-1-powershell-windows-10"},{"level":3,"title":"Option 2: PuTTY","id":"option-2-putty"},{"level":3,"title":"Option 3: Windows Subsystem for Linux (WSL)","id":"option-3-windows-subsystem-for-linux-wsl"},{"level":2,"title":"SSH Agent","id":"ssh-agent"},{"level":3,"title":"Start SSH Agent","id":"start-ssh-agent"},{"level":3,"title":"Agent Forwarding","id":"agent-forwarding"},{"level":2,"title":"File Transfer with SSH","id":"file-transfer-with-ssh"},{"level":3,"title":"SCP (Secure Copy)","id":"scp-secure-copy"},{"level":3,"title":"SFTP (SSH File Transfer Protocol)","id":"sftp-ssh-file-transfer-protocol"},{"level":3,"title":"Rsync over SSH","id":"rsync-over-ssh"},{"level":2,"title":"SSH Tunneling","id":"ssh-tunneling"},{"level":3,"title":"Local Port Forwarding","id":"local-port-forwarding"},{"level":3,"title":"Remote Port Forwarding","id":"remote-port-forwarding"},{"level":3,"title":"SOCKS Proxy","id":"socks-proxy"},{"level":2,"title":"SSH Security","id":"ssh-security"},{"level":3,"title":"Disable Root Login","id":"disable-root-login"},{"level":3,"title":"Disable Password Authentication","id":"disable-password-authentication"},{"level":3,"title":"Change SSH Port","id":"change-ssh-port"},{"level":3,"title":"Limit SSH Access","id":"limit-ssh-access"},{"level":3,"title":"Two-Factor Authentication","id":"two-factor-authentication"},{"level":2,"title":"Troubleshooting","id":"troubleshooting"},{"level":3,"title":"Permission Denied","id":"permission-denied"},{"level":3,"title":"Connection Timeout","id":"connection-timeout"},{"level":3,"title":"Host Key Verification Failed","id":"host-key-verification-failed"},{"level":3,"title":"Too Many Authentication Failures","id":"too-many-authentication-failures"},{"level":3,"title":"Connection Drops","id":"connection-drops"},{"level":2,"title":"SSH Best Practices","id":"ssh-best-practices"},{"level":3,"title":"Key Management","id":"key-management"},{"level":3,"title":"Connection Security","id":"connection-security"},{"level":3,"title":"Daily Usage","id":"daily-usage"},{"level":3,"title":"Monitoring","id":"monitoring"},{"level":2,"title":"Advanced SSH Tips","id":"advanced-ssh-tips"},{"level":3,"title":"Jump Hosts (Bastion)","id":"jump-hosts-bastion"},{"level":3,"title":"SSH Multiplexing","id":"ssh-multiplexing"},{"level":3,"title":"SSH Escape Sequences","id":"ssh-escape-sequences"},{"level":3,"title":"Remote Command Execution","id":"remote-command-execution"},{"level":2,"title":"SSH Clients","id":"ssh-clients"},{"level":3,"title":"Linux/Mac","id":"linuxmac"},{"level":3,"title":"Windows","id":"windows"},{"level":3,"title":"Mobile","id":"mobile"},{"level":2,"title":"Next Steps","id":"next-steps"}],"format":"markdown","word_count":1532,"content":"# SSH Access to VPS\n\nComplete guide to connecting to your VPS instances via SSH (Secure Shell).\n\n## What is SSH?\n\nSSH (Secure Shell) is a secure protocol for connecting to remote servers. It provides:\n\n- **Encrypted** connections\n- **Secure** authentication\n- **Remote** command execution\n- **File** transfer capabilities\n\n## Prerequisites\n\nBefore connecting:\n\n1. ✅ VPS instance is running\n2. ✅ SSH key is added to the instance\n3. ✅ Firewall allows port 22\n4. ✅ You have the public IP address\n\n## SSH Keys vs Passwords\n\n### SSH Keys (Recommended)\n\n**Advantages**:\n- More secure than passwords\n- Cannot be brute-forced\n- Convenient (no typing)\n- Can be revoked easily\n\n### Passwords\n\n**Disadvantages**:\n- Less secure\n- Can be brute-forced\n- Easy to forget\n- Harder to manage\n\n**We strongly recommend SSH keys!**\n\n### Choosing at Create Time\n\nWhen you create a VPS you pick one authentication method:\n\n- **SSH key** (recommended) — passwordless, key-based login\n- **Root password** — a password of at least 12 characters\n\nWindows Server instances always use a password (access is over RDP). Whichever you choose, you can further harden authentication from inside the OS once connected — see [SSH Security](#ssh-security).\n\n## Generating SSH Keys\n\n### On Linux/Mac\n\n```bash\n# Generate ED25519 key (recommended)\nssh-keygen -t ed25519 -C \"your_email@example.com\"\n\n# Or RSA key (if ED25519 not supported)\nssh-keygen -t rsa -b 4096 -C \"your_email@example.com\"\n\n# Follow prompts:\n# - Save location: Press Enter for default (~/.ssh/id_ed25519)\n# - Passphrase: Optional but recommended for extra security\n```\n\n**View your public key**:\n```bash\ncat ~/.ssh/id_ed25519.pub\n```\n\n### On Windows\n\n**Using PowerShell**:\n```powershell\n# Generate key\nssh-keygen -t ed25519 -C \"your_email@example.com\"\n\n# View public key\ntype $env:USERPROFILE\\.ssh\\id_ed25519.pub\n```\n\n**Using PuTTYgen**:\n1. Download PuTTYgen from [putty.org](https://www.putty.org/)\n2. Click **Generate**\n3. Move mouse for randomness\n4. Add passphrase (optional)\n5. Save private key\n6. Copy public key text\n\n### Key Components\n\n**Private Key** (`id_ed25519`):\n- Keep secret!\n- Never share\n- Never commit to git\n- Store securely\n\n**Public Key** (`id_ed25519.pub`):\n- Safe to share\n- Add to servers\n- Add to DanubeData dashboard\n\n## Adding SSH Keys to DanubeData\n\n### Method 1: During VPS Creation\n\n1. Create VPS instance\n2. In SSH Keys section, click **Add SSH Key**\n3. Paste your public key\n4. Name it (e.g., \"My Laptop\")\n5. Complete VPS creation\n\n### Method 2: Add to Existing Instance\n\n1. Go to **Profile** > **SSH Keys**\n2. Click **Add SSH Key**\n3. Paste public key\n4. Name it\n5. Click **Add**\n6. Attach to instances as needed\n\n### Public Key Format\n\nYour public key should look like:\n\n```\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqfBqGqv9Q... your_email@example.com\n```\n\nOr for RSA:\n\n```\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZk8... your_email@example.com\n```\n\nWhen you add a key, DanubeData validates the format and flags duplicates, so you won't accidentally add the same key twice.\n\n## Connecting via SSH\n\n### Basic Connection\n\n```bash\nssh root@YOUR_VPS_IP\n```\n\n**First Connection**:\n- You'll see host fingerprint\n- Type `yes` to confirm\n- Connection established!\n\n### With Custom Key\n\n```bash\nssh -i ~/.ssh/my_custom_key root@YOUR_VPS_IP\n```\n\n### With Custom Port\n\n```bash\nssh -p 2222 root@YOUR_VPS_IP\n```\n\n### With Username\n\n```bash\nssh username@YOUR_VPS_IP\n```\n\n## SSH Config File\n\nSimplify connections with SSH config:\n\n### Create Config\n\n```bash\nnano ~/.ssh/config\n```\n\n### Add Hosts\n\n```\n# Production Server\nHost prod-web\n    HostName 192.0.2.10\n    User root\n    IdentityFile ~/.ssh/id_ed25519\n    Port 22\n\n# Staging Server\nHost staging\n    HostName 192.0.2.20\n    User deploy\n    IdentityFile ~/.ssh/id_rsa\n    \n# Development Server\nHost dev\n    HostName 192.0.2.30\n    User ubuntu\n    IdentityFile ~/.ssh/id_ed25519\n```\n\n### Connect Using Alias\n\n```bash\n# Instead of: ssh root@192.0.2.10\nssh prod-web\n\n# Instead of: ssh deploy@192.0.2.20\nssh staging\n```\n\n**Much easier!**\n\n## SSH on Windows\n\n### Option 1: PowerShell (Windows 10+)\n\nSSH is built into Windows 10/11:\n\n```powershell\nssh root@YOUR_VPS_IP\n```\n\n### Option 2: PuTTY\n\n1. Download [PuTTY](https://www.putty.org/)\n2. Open PuTTY\n3. Enter hostname/IP\n4. Port: 22\n5. Connection type: SSH\n6. Click **Open**\n\n**Using SSH Key with PuTTY**:\n1. Convert key using PuTTYgen (Load private key → Save as .ppk)\n2. In PuTTY: Connection → SSH → Auth → Browse for private key\n3. Connect\n\n### Option 3: Windows Subsystem for Linux (WSL)\n\n```bash\n# Install WSL\nwsl --install\n\n# Use Linux SSH\nssh root@YOUR_VPS_IP\n```\n\n## SSH Agent\n\nSSH Agent stores your keys in memory:\n\n### Start SSH Agent\n\n```bash\n# Start agent\neval \"$(ssh-agent -s)\"\n\n# Add key\nssh-add ~/.ssh/id_ed25519\n\n# List keys\nssh-add -l\n\n# Remove keys\nssh-add -D\n```\n\n### Agent Forwarding\n\nUse your local keys on remote server:\n\n```bash\nssh -A root@YOUR_VPS_IP\n```\n\nOr in `~/.ssh/config`:\n```\nHost prod-web\n    ForwardAgent yes\n```\n\n**Warning**: Only use on trusted servers!\n\n## File Transfer with SSH\n\n### SCP (Secure Copy)\n\n**Upload file**:\n```bash\nscp local-file.txt root@YOUR_VPS_IP:/path/to/destination/\n```\n\n**Download file**:\n```bash\nscp root@YOUR_VPS_IP:/path/to/file.txt ./local-directory/\n```\n\n**Copy directory**:\n```bash\nscp -r local-directory/ root@YOUR_VPS_IP:/path/to/destination/\n```\n\n### SFTP (SSH File Transfer Protocol)\n\n**Interactive session**:\n```bash\nsftp root@YOUR_VPS_IP\n\n# SFTP commands:\nput local-file.txt          # Upload\nget remote-file.txt         # Download\nls                          # List remote files\nlls                         # List local files\ncd /path                    # Change remote directory\nlcd /path                   # Change local directory\nquit                        # Exit\n```\n\n### Rsync over SSH\n\nBest for syncing directories:\n\n```bash\n# Sync local to remote\nrsync -avz -e ssh ./local/ root@YOUR_VPS_IP:/remote/\n\n# Sync remote to local\nrsync -avz -e ssh root@YOUR_VPS_IP:/remote/ ./local/\n\n# Options:\n# -a: archive mode\n# -v: verbose\n# -z: compress\n# -e ssh: use SSH\n```\n\n## SSH Tunneling\n\n### Local Port Forwarding\n\nAccess remote service on local machine:\n\n```bash\n# Forward remote MySQL to local port 3306\nssh -L 3306:localhost:3306 root@YOUR_VPS_IP\n\n# Now connect locally:\nmysql -h 127.0.0.1 -P 3306\n```\n\n### Remote Port Forwarding\n\nExpose local service to remote server:\n\n```bash\n# Forward local service to remote\nssh -R 8080:localhost:3000 root@YOUR_VPS_IP\n```\n\n### SOCKS Proxy\n\nRoute traffic through SSH:\n\n```bash\nssh -D 8080 root@YOUR_VPS_IP\n\n# Configure browser to use SOCKS proxy: localhost:8080\n```\n\n## SSH Security\n\n### Disable Root Login\n\n```bash\n# Edit SSH config\nsudo nano /etc/ssh/sshd_config\n\n# Change to:\nPermitRootLogin no\n\n# Restart SSH\nsudo systemctl restart sshd\n```\n\n### Disable Password Authentication\n\n```bash\n# Edit SSH config\nsudo nano /etc/ssh/sshd_config\n\n# Change to:\nPasswordAuthentication no\nPubkeyAuthentication yes\n\n# Restart SSH\nsudo systemctl restart sshd\n```\n\n### Change SSH Port\n\n```bash\n# Edit SSH config\nsudo nano /etc/ssh/sshd_config\n\n# Change port:\nPort 2222\n\n# Restart SSH\nsudo systemctl restart sshd\n\n# Update firewall:\nsudo ufw allow 2222/tcp\nsudo ufw delete allow 22/tcp\n```\n\n### Limit SSH Access\n\n**By IP**:\n```bash\n# UFW\nsudo ufw allow from YOUR_IP to any port 22\n\n# Or in /etc/ssh/sshd_config:\nAllowUsers root@YOUR_IP\n```\n\n**By user**:\n```bash\n# /etc/ssh/sshd_config:\nAllowUsers john jane\n```\n\n### Two-Factor Authentication\n\nAdd extra security layer:\n\n```bash\n# Install Google Authenticator\nsudo apt install libpam-google-authenticator -y\n\n# Configure for user\ngoogle-authenticator\n\n# Edit PAM config\nsudo nano /etc/pam.d/sshd\n# Add: auth required pam_google_authenticator.so\n\n# Edit SSH config\nsudo nano /etc/ssh/sshd_config\n# Set: ChallengeResponseAuthentication yes\n\n# Restart SSH\nsudo systemctl restart sshd\n```\n\n## Troubleshooting\n\n### Permission Denied\n\n**Check key is added**:\n```bash\nssh-add -l\n```\n\n**Add key**:\n```bash\nssh-add ~/.ssh/id_ed25519\n```\n\n**Verify key on server**:\n```bash\ncat ~/.ssh/authorized_keys\n```\n\n### Connection Timeout\n\n**Check firewall**:\n- Verify firewall allows port 22\n- Check cloud firewall rules\n- Test with: `telnet YOUR_VPS_IP 22`\n\n**Check SSH service**:\n```bash\n# Use web console\nsudo systemctl status sshd\nsudo systemctl start sshd\n```\n\n### Host Key Verification Failed\n\nServer key changed (reinstall or new server):\n\n```bash\n# Remove old key\nssh-keygen -R YOUR_VPS_IP\n\n# Reconnect (will add new key)\nssh root@YOUR_VPS_IP\n```\n\n### Too Many Authentication Failures\n\n**Specify key**:\n```bash\nssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 root@YOUR_VPS_IP\n```\n\n**Or in config**:\n```\nHost *\n    IdentitiesOnly yes\n```\n\n### Connection Drops\n\n**Keep alive**:\n```bash\n# Add to ~/.ssh/config:\nHost *\n    ServerAliveInterval 60\n    ServerAliveCountMax 3\n```\n\n**On server** (`/etc/ssh/sshd_config`):\n```\nClientAliveInterval 60\nClientAliveCountMax 3\n```\n\n## SSH Best Practices\n\n### Key Management\n1. Use ED25519 keys (modern, secure)\n2. Use passphrase on private keys\n3. One key per device\n4. Rotate keys regularly\n5. Remove old/unused keys\n\n### Connection Security\n1. Disable password authentication\n2. Disable root login\n3. Use non-standard port\n4. Limit access by IP\n5. Use 2FA for critical servers\n\n### Daily Usage\n1. Use SSH config file\n2. Use SSH agent\n3. Keep private keys secure\n4. Never share private keys\n5. Use different keys for different purposes\n\n### Monitoring\n1. Review SSH logs: `sudo tail -f /var/log/auth.log`\n2. Check failed attempts\n3. Use fail2ban\n4. Monitor unusual activity\n\n## Advanced SSH Tips\n\n### Jump Hosts (Bastion)\n\nConnect through intermediate server:\n\n```bash\nssh -J bastion@jump-host root@final-server\n```\n\nOr in config:\n```\nHost final-server\n    ProxyJump bastion@jump-host\n```\n\n### SSH Multiplexing\n\nShare connections:\n\n```\nHost *\n    ControlMaster auto\n    ControlPath ~/.ssh/control-%r@%h:%p\n    ControlPersist 10m\n```\n\nBenefits:\n- Faster subsequent connections\n- Less overhead\n- Shared authentication\n\n### SSH Escape Sequences\n\nDuring SSH session:\n- `~.` - Disconnect\n- `~^Z` - Suspend SSH\n- `~#` - List forwarded connections\n- `~?` - Help\n\n### Remote Command Execution\n\nRun command without interactive session:\n\n```bash\n# Single command\nssh root@YOUR_VPS_IP 'uptime'\n\n# Multiple commands\nssh root@YOUR_VPS_IP 'cd /var/www && ls -la'\n\n# Script execution\nssh root@YOUR_VPS_IP 'bash -s' < local-script.sh\n```\n\n## SSH Clients\n\n### Linux/Mac\n- **OpenSSH**: Built-in, most common\n- **Termius**: Modern GUI client\n- **iTerm2** (Mac): Terminal with SSH features\n\n### Windows\n- **OpenSSH**: Built into Windows 10+\n- **PuTTY**: Popular, free\n- **MobaXterm**: Feature-rich\n- **Termius**: Modern, cross-platform\n- **Windows Terminal**: Modern terminal\n\n### Mobile\n- **Termius**: iOS/Android\n- **JuiceSSH**: Android\n- **Blink Shell**: iOS\n\n## Next Steps\n\n- [VPS Management](https://docs.danubedata.ro/vps-managing)\n- [Firewall Configuration](https://docs.danubedata.ro/networking-firewalls)\n- [Security Best Practices](https://docs.danubedata.ro/platform-security)\n- [Monitoring Setup](https://docs.danubedata.ro/monitoring-overview)\n\nNeed help with SSH? Contact support through the dashboard.\n\n","prev":{"title":"Custom Cloud-Init","slug":"vps-cloud-init","url":"https://docs.danubedata.ro/vps-cloud-init","markdown_url":"https://docs.danubedata.ro/vps-cloud-init.md","json_url":"https://docs.danubedata.ro/vps-cloud-init.json"},"next":{"title":"Snapshots","slug":"vps-snapshots","url":"https://docs.danubedata.ro/vps-snapshots","markdown_url":"https://docs.danubedata.ro/vps-snapshots.md","json_url":"https://docs.danubedata.ro/vps-snapshots.json"},"index_url":"https://docs.danubedata.ro/index.json"}