SSH keypairs (optional)
Manage optional SSH keypairs for tenant Linux instances.
A keypair lets you inject an SSH public key into a Linux instance at boot time. On mustelinet, keypairs are not the normal external SSH access path. External tenant SSH uses Pomerium-backed mustelinet SSH and GitHub SSO through auth.mustelinet.com.
SSH keypairs can still be useful when you need SSH between VMs on the same project subnet and the security groups allow that traffic.
If you only need dashboard console access, choose Login Type Password when creating the VM and use Skyline console access instead of creating a keypair.
🔑 Optional for most tenant SSH
Use mustelinet SSH for external access. Create a keypair only when the image, launch workflow, or VM-to-VM access pattern requires it.
External SSH
Use Pomerium-backed mustelinet SSH, GitHub SSO, and the route on ssh.mustelinet.com.
VM-to-VM SSH
Keypairs can help when one VM must SSH to another inside the same project network.
Import public keys only
Paste public keys into Skyline. Keep private keys outside OpenStack and version control.
Rotate exposed keys
If a private key is lost or leaked, replace the keypair and update affected instances.
Create or import a keypair
- Open Compute, then Key Pairs.
- Choose Create Key Pair or Import Key Pair.
- If Skyline generates a keypair, download the private key immediately.
- If you import a keypair, paste only the public key.
- Select the keypair when creating an instance only if your workflow needs key-based SSH inside the project network.
Protect the private key
The private key belongs to you. The platform cannot recover it if you lose it.
Keep private keys out of:
- Git repositories.
- Terraform state.
- Shared chat systems.
- Shared messages or issue notes.
If a private key is lost or exposed, create a new keypair and rotate access on affected instances.
Choose the right SSH user
The default SSH username depends on the image. Common examples include:
| Image family | Common SSH user |
|---|---|
| Ubuntu | ubuntu |
| Debian | debian |
| Rocky or CentOS | rocky, centos, or cloud-user |
Root SSH is denied by policy for tenant access. Use the image's normal cloud user and privilege escalation inside the VM when allowed by the image.
SSH keypairs and mustelinet SSH
Pomerium-backed mustelinet SSH is the external tenant SSH path. A keypair alone does not grant external SSH access to a VM.
VM-to-VM SSH
If you need to SSH from one VM to another VM on the same subnet:
- Import or create a keypair.
- Launch the target VM with the public key.
- Keep the private key only on the source VM or in your own secure storage.
- Add a security group rule that allows TCP port
22from the source VM, source subnet, or source security group.
Do not open extra SSH paths unless the workload needs them.