SSH access

Cloud's SSH gateway opens the same shell as the web terminal, from the SSH client on your own machine. You add a public key to your account once; after that, any running service you own, in any of your organizations, is one ssh command away. The shell opens inside the service's first running container, never on the server underneath it.

1. Find or create a key pair

   Use the single line of a public key file, such as ~/.ssh/id_ed25519.pub. If you have none, create one:

   TerminalBashCopy

   ssh-keygen -t ed25519

2. Add the public key to Cloud

   Open Settings, then SSH keys, and press Add SSH key. In the dialog, give the key a Name you will recognise, such as the machine it lives on, paste the line into Public key, and press Add key.

3. Check the fingerprint

   The table lists the key with its Fingerprint, which starts SHA256:. Compare it with what your machine prints for the same file:

   TerminalBashCopy

   ssh-keygen -lf ~/.ssh/id_ed25519.pub

   The two SHA256: strings match when Cloud holds the key you meant to add.

Cloud stores the key's type and the key itself, and drops the comment at the end of the line. It never shows the key back: the table lists each key's Name (with its type under it), Fingerprint, Added and Last used, which reads "Never" until the key first opens a shell.

An account holds up to 20 keys. A key belongs to one account only, so the same public key cannot be added to a second Cahaves Cloud account. A key's name is 1 to 64 characters.

The dialog says why under the field:

Copy the command from the Terminal page: pick a running service, choose a Shell, and use the copy button on the Connect with SSH line. The command carries the gateway's address, and a port when the gateway listens on one other than SSH's own. Its shape is:

ssh <service-id>@<gateway>

The user name is the service's id, which is how the gateway knows which service you are asking for. To open a shell other than sh, the id is followed by a plus and the shell's name; choosing that shell on the Terminal page puts it in the copied command for you:

ssh <service-id>+bash@<gateway>

A shell other than sh opens only when the service's image includes it.

The first time you connect, your SSH client shows the gateway's host key fingerprint and asks whether to trust it. Accept it to continue; your client remembers the key and warns you if it ever changes. The console does not display the gateway's host key, so if your client later warns that it has changed, stop and contact support before accepting the new one.

Over SSH, the shell always opens in the service's first running container. To enter a particular replica or compose container, use the Container menu on the Terminal page.

When the shell ends normally, ssh exits with status 0. When the gateway refuses, it prints the reason and ssh exits with status 1.

The gateway gives you an interactive shell and nothing else. Every key, every service and every shell is checked by Cloud at each connection.

Remote forwarding (-R), agent forwarding and X11 are declined without a sentence of their own, and variables your client sends with SendEnv are ignored. Like the web terminal, the shell is 80 by 24 and does not resize, and it closes with "Closed after 30 minutes idle." when nothing is typed or printed for thirty minutes.

A key is refused before any shell, and your client reports that the server denied the public key, when:

• the key is not on any Cahaves Cloud account;

• the user name is not the id of a service your account owns, for example after the service was deleted;

• the part after the plus is not sh, bash, zsh or ash;

• the account is banned.

SSH refused goes through each case.

A suspended account keeps its keys. Suspension stops the services of every organization of the account, though, so a connection finds nothing to open and prints "Nothing is running." Once the account is active again and a service runs, the same command opens its shell. Billing explains suspension.

A banned account's keys are refused at authentication, whatever service they name.

On Settings, then SSH keys, press Remove beside the key and confirm with Remove key. The key stops opening new shells at once. A shell already open with it stays open until it ends. The Last used column helps find keys nobody uses any more.