Access & SSH

1. What the tab contains

Three things, each governed by its own permission:

A team member without one of these sees that part restricted rather than hidden behind a failure. The three are separate on purpose: you can let someone use the browser terminal without letting them add new keys, which would otherwise be a way to grant themselves permanent access.

2. SSH keys

The list shows the keys authorised on this server. No SSH key assigned to this server means nobody can log in by key yet.

Public keys are shown as Public key hidden for security rather than printed in full — the panel holds them, but a shoulder-surfed screen should not leak which keys open which servers.

Two ways to add a key

Add New SSH Key offers a choice:

Generate a key

The panel creates a keypair and installs the public half on the server.

1. 1Enter a key name — e.g. my-ssh-key. Required, and validated.
2. 2Generate Key.
3. 3The panel shows Generating and installing SSH key…, then Installing SSH key on server…, then confirms.

Copy Public Key and Copy Password put the credentials on your clipboard.

Upload your own

Paste a key you already have:

• Enter a key name.
• Paste your public key here — the id_rsa.pub style public key, not the private one.
• Submit.

The panel refuses an empty name (Please enter a key name) or an empty key (Please enter a public key), and validates the name format.

Uploading is the better choice when you already have a key you use elsewhere: your private key never touches the panel at all.

Deleting a key

Delete SSH Key, behind a confirmation.

Deleting removes it from the server's authorised keys — anyone using that key loses access immediately. Make sure it is not the key you are currently connected with, and not the only key on the server.

Why add keys here rather than by hand

Editing authorized_keys over SSH works, but the panel then has no record of it: the list on this page is what it installed, and a key added by hand is invisible to it. Adding keys here keeps the list truthful, which matters when someone leaves and you need to know what still has access.

3. The root password

Password with Copy Password — the server's root credentials, for providers and situations where password login applies.

Keys are better than passwords for routine access: a key cannot be guessed, and revoking one person's key does not disturb anyone else. Treat the password as the fallback.

4. SSH Terminal

Launch SSH Terminal opens a shell in the browser — no local SSH client, no key on the machine you happen to be sitting at.

The session runs in a sandboxed frame with a limited permission set, and is tied to a session token rather than being permanently open.

Sessions expire. Session not found or expired and Invalid session mean exactly that — launch it again. This is deliberate: a browser tab left open on a shared machine should not stay a live root shell indefinitely.

Failed to start SSH session usually means the server is unreachable rather than that your credentials are wrong — check the server is running and that the firewall allows the panel to reach it.

When to use the terminal

Good for a quick look — checking a log, confirming a process, running a one-off command. For anything longer, connect with your own SSH client: you get scroll history, file transfer and a session that survives a page reload.

5. Access and manageability

Granting root access changes the server's relationship with the panel.

A server is one of:

• Panel Manageable — the panel manages the stack, and every section works.
• Partially Manageable — some functions unavailable.
• Root — root access has been granted; the panel no longer guarantees the configuration.

This is not a punishment, it is honesty. Once someone can change the machine by hand, the panel cannot promise its view is accurate, and it says so on the server card rather than quietly being wrong.

6. Sensible practice

• One key per person, not one shared key. Revoking access then means deleting one key, not rotating everyone's.
• Upload rather than generate when you already have a key — your private key never reaches the panel.
• Name keys after people or machines — alice-laptop, ci-runner — not key1. The list is your access record.
• Remove keys when someone leaves. This tab is the only place that reliably shows what still has access.
• Do not delete the key you are connected with.
• Prefer keys to the root password for day-to-day work.
• Use the browser terminal for quick checks, your own client for real work.

7. Common problems