Create and change SSH keys

Each computer needs the private key corresponding to a public key saved in your storage account. A separate key per computer makes it easier to remove one device later.

Generate a key

Run this on the computer that will connect. On Linux or macOS:

mkdir -p ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/caliber-storage -C "caliber-storage"

In PowerShell with Windows OpenSSH installed:

New-Item -ItemType Directory -Force "$HOME/.ssh" | Out-Null
ssh-keygen -t ed25519 -f "$HOME/.ssh/caliber-storage" -C "caliber-storage"

Choose a passphrase when prompted. If that filename already exists, choose a new filename instead of overwriting a key you use.

The command creates:

• caliber-storage: the private key, kept on your computer.
• caliber-storage.pub: the public key, copied into the panel.

Display the public key on Linux/macOS:

cat ~/.ssh/caliber-storage.pub

Or in PowerShell:

Get-Content "$HOME/.ssh/caliber-storage.pub"

Copy the whole line beginning ssh-ed25519. The panel accepts Ed25519 or RSA keys of at least 3072 bits, with up to ten public keys per account. If you need RSA, generate it with ssh-keygen -t rsa -b 3072 and a distinct filename.

Add or replace a key

1. Open Storage → Backup Storage → Manage storage.
2. Under SSH keys, select Manage SSH keys.
3. Keep any existing keys that should retain access. Add the new public key on its own line.
4. Select Save keys. Changes normally apply within one minute.
5. Test the new key in a fresh connection.
6. Once it works, edit the list again and remove any retired key.

Editing the public SSH keys for a storage account. Current panel with example data; use the values in your account.

Editing the public SSH keys for a storage account. Current panel with example data; use the values in your account.

The editor replaces the saved list. Removing a line removes that key's future login access; it does not delete files. Never paste the private key or a block beginning BEGIN OPENSSH PRIVATE KEY.

Lost key or new computer

Generate a new key and add its public half through the panel. You do not need the old private key to change the account's public keys. Remove the lost key after testing the replacement.

For an encrypted key, load it into your local SSH agent so tools can reuse the unlocked key:

ssh-add ~/.ssh/caliber-storage

If the agent is not running, enable your operating system's SSH-agent service first. A scheduled job must be able to access its key without an interactive prompt; test it as the same user that runs the schedule.