DocsICP FilingConsole
官方文档
首页

Manage key pairs (Linux)

更新时间：
复制 MD 格式
产品详情
我的收藏

SSH key pairs authenticate Linux-based Simple Application Server instances through public-private key cryptography, providing stronger security than password-based login.

Advantages

SSH key pair-based authentication provides the following advantages over username/password-based authentication:

  • Increased security: SSH key pairs provide higher security and reliability for authentication.

    • SSH key pairs are more secure than regular passwords against brute-force attacks.

    • Private keys cannot be deduced from public keys regardless of whether the public keys are maliciously acquired.

  • Ease of use:

    • If you configure a public key on a Linux instance, you can run an SSH command or use a connection tool to log on to the instance by using the corresponding private key instead of a password.

    • You can log on to multiple Linux instances at the same time by using an SSH key pair. This way, you can manage your instances in a more convenient manner. If you want to batch maintain multiple Linux instances, we recommend that you use the SSH key pair-based authentication method.

Limitations

  • SSH key pairs are supported only for Linux instances.

  • Maximum 10 key pairs per region per account.

  • The console creates only 2048-bit RSA key pairs.

Create or import a key pair

Create a key pair in the console or import an existing one, then bind it to an instance for SSH login.

  1. Go to the Key Pair page in the Simple Application Server console.

  2. On the Key Pair page, click Create Key Pair.

  3. In the Create Key Pair dialog box, configure the parameters and click OK.

    Create automatically

    Configure the following parameters:

    Parameter

    Description

    Key Pair Name

    Enter a key pair name: 2–64 characters, starts with a letter or Chinese character, can contain digits, colons (:), underscores (_), and hyphens (-).

    Creation Mode

    Select Auto-Generate Key Pair.
    Important

    • The private key file (.pem) downloads automatically. This is your only chance to save it — store it securely.

    • If no download prompt appears, check your browser's download manager for blocked downloads.

    Import existing

    If you already have a key pair that uses a supported encryption method, you can import its public key. Q2: What encryption methods are supported for importing a key pair?

    Configure the following parameters:

    Parameter

    Description

    Key Pair Name

    Enter a key pair name: 2–64 characters, starts with a letter or Chinese character, can contain digits, colons (:), underscores (_), and hyphens (-).

    Creation Mode

    Select Import Key Pair.

    Public Key

    Paste your public key. For format examples, hover over Base64 Preview. Q3: How do I view public key information?

  4. In the Create Key Pair dialog box, choose whether to bind an instance now.

    You can also bind the key pair later. Bind a key pair.

Bind a key pair

The target instance must be in the Running or Stopped state.

Important

  1. Go to the Key Pair page in the Simple Application Server console.

  2. On the Key Pair page, in the Actions column of the target key pair, click Bind to Instance.

  3. In the Bind to Instance dialog box, select one or more Linux-based Simple Application Server instances and click the image icon.

  4. Click OK.

  5. In the Bind to Instance dialog box, choose whether to restart the instance now.

    • Click Restart Now to restart now. The key pair takes effect after restart.

      Warning

      The restart operation stops the instance for a short period of time and may interrupt services that are running on the instance. We recommend that you restart the instance during off-peak hours.

    • Click Do Not Restart to skip restart. Restart the instance manually during off-peak hours for the key pair to take effect.

After the key pair takes effect, use it to log in to the instance. Connect to a Linux server.

Unbind a key pair

Unbind an SSH key pair to replace it or to revoke a user's access to an instance.

Important

After a key pair is bound and the instance is restarted, password-based login for the root user is automatically disabled. To re-enable it, modify the server configuration file. Connect to a Linux server.

  1. Go to the Key Pair page in the Simple Application Server console.

  2. On the Key Pair page, in the Actions column of the target key pair, click Unbind from Instance.

  3. In the Unbind from Instance dialog box, select one or more Linux-based Simple Application Server instances and click the image icon.

  4. Click OK.

  5. In the Unbind from Instance dialog box, choose whether to restart the instance now.

    • Click Restart Detached Instance to restart now. The unbinding takes effect after restart.

      Warning

      The restart operation stops the instance for a short period of time and may interrupt services that are running on the instance. We recommend that you restart the instance during off-peak hours.

    • Click Do Not Restart to skip restart. Restart the instance manually during off-peak hours for the unbinding to take effect.

Delete a key pair

Unbind a key pair from all associated instances before deleting it.

  1. Go to the Key Pair page in the Simple Application Server console.

  2. On the Key Pair page, in the Actions column of the target key pair, click Delete.

  3. In the Delete Key Pair dialog box that appears, click OK.

FAQ

Use multiple key pairs to log in

To use multiple key pairs, edit the ~/.ssh/authorized_keys file on the instance:

  1. Connect to the Linux instance by using an existing SSH key pair.

    Important

    The key pair is bound to the root user. Make sure that you are logged in as the root user.

  2. Run the following command to open the .ssh/authorized_keys file: 

    sudo vim .ssh/authorized_keys

  3. Press the i key to enter edit mode and add or replace the public key information.

    • You can add and save new public key information below the existing public key information. 

      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCys3aOkFm1Xh8iN0lijeQF5mz9Iw/FV/bUUduZjauiJa1KQJSF4+czKtqMAv38QEspiWStkSfpTn1g9qeUhfxxxxxxxxxx+XjPsf22fRem+v7MHMa7KnZWiHJxO62D4Ihvv2hKfskz8K44xxxxxxxxxx+u17IaL2l2ri8q9YdvVHt0Mw5TpCkERWGoBPE1Y8vxFb97TaE5+zc+2+eff6xxxxxxxxxx/feMeCxpx6Lhc2NEpHIPxMpjOv1IytKiDfWcezA2xxxxxxxxxx/YudCmJ8HTCnLId5LpirbNE4X08Bk7tXZAxxxxxxxxxx/FKB1Cxw1TbGMTfWxxxxxxxxxx imported-openssh-key
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdlrdZwV3+GF9q7rhc6vYrExwT4WU4fsaRcVXGV2Mg9RHex21hl1au77GkmnIgukBZjywlQOT4GDdsJy2nBOdJPrCEBIPxxxxxxxxxxx/fctNuKjcmMMOA8YUT+sJKn3l7rCLkesE+S5880yNdRjBiiUy40kyr7Y+fqGVdSOHGMXZQPpkBtojcxxxxxxxxxx/htEqGa/Jq4fH7bR6CYQ2XgH/hCap29Mdi/G5Tx1nbUKuIHdMWOPvjxxxxxxxxxx+lHtTGiAIRG1riyNRVC47ZEVCg9iTWWGrWFvxxxxxxxxxx/9H9mPCO1Xt2fxxxxxxxxBtmR imported-openssh-key
      Note

      If the public key file contains information about multiple public keys, you can log on to the Linux instance by using the paired private keys.

    • You can delete existing public key information and then add and save new public key information. 

      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdlrdZwV3+GF9q7rhc6vYrExwT4WU4fsaRcVXGV2Mg9RHex21hl1au77GkmnIgukBZjywlQOT4GDdsJy2nBOdJPrCEBIP6t0Mk5aPkK/fctNuKjcmMMOA8YUT+sJKn3l7rCLkesE+S5880yNdRjBiiUy40kyr7Y+fqGVdSOHGMXZQPpkBtojcV14uAy0yV6/htEqGa/Jq4fH7bR6CYQ2XgH/hCap29Mdi/G5Tx1nbUKuIHdMWOPvjGACGcXclex+lHtTGiAIRG1riyNRVC47ZEVCg9iTWWGrWFvVlnI0E3Deb/9H9mPCO1Xt2fxxxxxxxxBtmR imported-openssh-key

  4. After you add or replace the public key information, press the Esc key to exit the edit mode and enter :wq to save the changes.

  5. Use the new SSH key pair to log on to the Linux instance. For more information, see Use OpenSSH or Xshell.

    If you can log on to the Linux instance by using the new private key, the new SSH key pair is added or the old SSH key pair is replaced.

Q2: What encryption methods are supported for importing a key pair?

A2: An imported key pair must use one of the following encryption methods:

  • rsa

  • dsa

  • ssh-rsa

  • ssh-dss

  • ecdsa

  • ssh-rsa-cert-v00@openssh.com

  • ssh-dss-cert-v00@openssh.com

  • ssh-rsa-cert-v01@openssh.com

  • ssh-dss-cert-v01@openssh.com

  • ecdsa-sha2-nistp256-cert-v01@openssh.com

  • ecdsa-sha2-nistp384-cert-v01@openssh.com

  • ecdsa-sha2-nistp521-cert-v01@openssh.com

Q3: How do I view public key information?

A3: You can view the public key by using one of the following methods:

On Windows

To view public key information, perform the following operations:

  1. Start PuTTYgen.

  2. Click Load.

  3. Select the .ppk or .pem file.

    PuTTYgen displays the public key information.

On Linux or macOS

Run the ssh-keygen command in which the path of the .pem file is specified. 

ssh-keygen -y -f /path_to_key_pair/my-key-pair.pem

The following example shows the returned public key information: 

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABA****+GF9q7rhc6vYrExwT4WU4fsaRcVXGV2Mg9RHex21hl1au77GkmnIgukBZjywlQOT4GDdsJy2nBOdJPrCEBIPxxxxxxxxxx/fctNuKjcmMMOA8YUT+sJKn3l7rCLkesE+S5880yNdRjBiiUy40kyr7Y+fqGVdSOHGMXZQPpkBtojcxxxxxxxxxxx/htEqGa/Jq4fH7bR6CYQ2XgH/hCap29Mdi/G5Tx1nbUKuIHdMWOPvjxxxxxxxxxx+lHtTGiAIRG1riyNRVC47ZEVCxxxxxx

From within an instance

  1. Connect to the Linux instance by using an existing SSH key pair.

    Important

    The key pair is bound to the root user. Make sure that you are logged in as the root user.

  2. Run the following command to view the public key information of an SSH key pair: 

    sudo cat ~/.ssh/authorized_keys
    Note

    The public key information is stored in the ~/.ssh/authorized_keys file. Open the file on the instance to view the public key information.

Related operations

Manage key pairs programmatically with these API operations:

Previous：Set or reset an instance passwordNext：Manage simple application servers