About key pairs

• Create a key pair
• Obtain information about your key pairs
• Modify the key pair of a VM
• Delete a key pair

Key pairs are pairs of SSH (Secure Shell) keys that let you connect to your VM (Virtual Machine). When you create a VM, you must specify the key pair you want to use and use its private key to connect to the VM.

Public key and private key

A key pair consists of a public key and a private key.

You can:

• Generate a key pair in 2048-bit RSA format using the API (Application Programming Interface) or the console.
• Import an existing key pair created using a third-party tool, from the following types: RSA (2048 bits or preferably 4096 bits), Ed25519, and ECDSA (256 bits, 384 bits, or 521 bits). The following formats can be used: PEM, PKCS8, RFC4716, and OpenSSH.

warning

Give explicit names to your key pairs so that their role is understood. You can, for example, use names in the application-environment-role format:

• website-all-bastion
• website-front-lb
• website-middle-app
• website-back-db

In all cases, the public key of the key pair is kept by Numspot, and is available only in the metadata of the VM. The private key, however, is never transmitted to Numspot.

For Linux VM created from a non-official image, you can replace the public key of the key pair in the authorized_keys file with that of a new key pair.

Key pairs and Image

All official images use key pairs as their authentication system. When creating a VM from an official image, you must assign it a key pair:

• For Linux VM, the VM obtains the public key of the key pair from the metadata and associates it with the root user by inserting it into the home directory, in the authorized_keys file.
• For Windows VM, the key pair lets you obtain and decrypt the Administrator password when creating the VM.

info

Only RSA key pairs can decrypt the password of a Windows VM.

However, non-official images can use any authentication system. When creating a VM, you must check whether a key pair is required for the specified image.

warning

We strongly recommend that you use only official images. We cannot guarantee the security of VM created from images from other sources.

After your first connection to a VM, you can:

• Replace the assigned key pair.
• Replace the key pair with another authentication system of your choice, for example the Kerberos or Radius protocols.
• Add one or more authentication systems in addition to the key pair.