Core Infrastructure

SSH Keys

Manage secure SSH key-based access for StrataGateway Linux compute instances.

Preview

Development Preview

SSH key management is currently part of the StrataGateway platform development roadmap. Interfaces, API endpoints, key limits, and provisioning behavior may change before public release.

Jump to article

Overview

SSH keys provide a secure method for accessing StrataGateway Linux compute instances. The model uses asymmetric cryptography: a private key remains on the user's trusted device, while the corresponding public key is stored by the platform and injected during instance provisioning for authorized access.

Private key

Remains on the user's trusted device. Never upload or share it.

Public key

Stored by the platform and used for authorized instance access.

Never upload your private SSH key to StrataGateway. Only public keys should be registered with the platform.

Why use SSH keys

SSH keys are the recommended authentication method for Linux compute instances. They offer stronger protection than reusable passwords and integrate naturally with automated workflows.

Stronger authentication than reusable passwords
Resistant to brute-force password attacks
Suitable for automation and CI/CD pipelines
Easier key rotation and revocation
Better developer workflows and audit trails
No shared secrets across infrastructure boundaries

Your private key must remain secret and should never be uploaded to StrataGateway or shared with another person.

Generate a key pair

Generate an Ed25519 key pair using the following command. Ed25519 keys are recommended for their performance and security characteristics.

Generate SSH key

Generate SSH keyBash
ssh-keygen -t ed25519 -C "[email protected]"

Generated files

~/.ssh/id_ed25519Private key
~/.ssh/id_ed25519.pubPublic key

Never expose the contents of id_ed25519. Only the .pub file should be uploaded to StrataGateway.

Add a public key

Preview

Preview workflow

Once the StrataGateway Cloud Console is available, public keys can be registered through the following planned workflow:

Settings→SSH Keys→Add SSH Key

Name

Personal Laptop

Public Key

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...

Public account access and SSH key management are not yet publicly available. This section documents the planned onboarding flow.

Key format

StrataGateway is planned to support Ed25519 and RSA public key formats. Ed25519 is recommended for new key generation.

Planned supported formats

Preview

Ed25519

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExamplePublicKeyValue [email protected]

RSA

ssh-rsa AAAAB3NzaC1yc2EExamplePublicKeyValue [email protected]

Ed25519 is recommended for new keys due to better performance and stronger security properties.

Use a key with an instance

Preview

Preview workflow

During instance provisioning, a registered SSH key can be selected for injection into the new instance. The planned workflow follows the Create Instance flow.

Create Instance→Select image→Select region→Select SSH key→Deploy

Example

Instance

web-prod-01

Image

Ubuntu 24.04 LTS

SSH Key

Personal Laptop

The selected public key is intended to be installed during provisioning so that the associated private key can be used for immediate SSH access.

Connect over SSH

Once the instance is provisioned and has a public IP, connect using the private key associated with the registered public key.

Connect with SSH

Connect with SSHBash
ssh [email protected]

Connect with explicit key

Connect with explicit keyBash
ssh -i ~/.ssh/id_ed25519 [email protected]

The example IP 203.0.113.10 is a documentation-only address from a reserved range and does not represent a real StrataGateway instance.

The SSH client may ask you to verify the host fingerprint before connecting.

Verify host fingerprints before trusting a new server.

Multiple keys

StrataGateway is planned to support multiple public keys per account, allowing different keys for different devices, workflows, and access patterns.

Example key inventory

Personal Laptop
Workstation
CI/CD Runner
Emergency Access

Final key limits will be documented before public release.

Remove a key

Planned

Planned behavior

Removing a stored SSH key from the StrataGateway control plane prevents it from being selected for future provisioning workflows. However, removal may not automatically remove the key from servers where it was already installed.

Existing authorized_keys entries on running instances may require manual removal or a rebuild depending on final platform behavior.

Security recommendations

Prefer Ed25519 keys over RSA
Protect private keys with appropriate filesystem permissions
Use passphrases where practical
Do not share private keys
Use separate keys for automation and personal access
Rotate compromised keys immediately
Remove unused public keys regularly
Restrict SSH access with firewall rules
Verify host fingerprints on first connection
Avoid password-based root login

Treat SSH keys as sensitive credentials. Rotate any key that may have been exposed.

API preview

Preview

REST API Preview

The API surface below is illustrative and reflects the planned request and response structure for SSH key management. Do not interpret it as a live endpoint contract.

Register SSH key

Register SSH keycURL
curl -X POST "https://api.stratagateway.com/v1/ssh-keys" \
  -H "Authorization: Bearer $STRATA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Personal Laptop",
    "public_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI..."
  }'

Illustrative response

Illustrative responseJSON
{
  "id": "key_8f3a9b1c",
  "name": "Personal Laptop",
  "fingerprint": "SHA256:example",
  "created_at": "2026-07-24T12:00:00Z"
}

Illustrative API preview. Production endpoints, request formats, identifiers, and response formats may change before public release.

Read the REST API preview

Was this page helpful?