Logging In to a Linux ECS Using an SSH Key Pair

Key pairs (SSH key pairs) are a set of security credentials for identity authentication when you remotely log in to ECSs.

A key pair consists of a public key and a private key. Key Pair Service (KPS) stores the public key and you store the private key. If you have bound a public key to a Linux ECS, you can use the corresponding private key, rather than a password, to log in to the ECS. You do not need to worry about password interception, cracking, or leakage.

For details, see Application Scenarios for Using Key Pairs.

This section describes how to use an SSH key pair to remotely log in to a Linux ECS from a Windows and a Linux server, respectively.

• The ECS status must be Running.
• You have obtained the private key file (.pem) generated during the ECS creation. For details about how to create a key pair, see (Recommended) Creating a Key Pair on the Management Console.
• You have bound an EIP to the ECS. For details, see Viewing ECS Details.

You have two methods to log in to a Linux ECS from a local Windows server.

Method 1: Use PuTTY to log in to the ECS.

The following operations use PuTTY as an example. Before using PuTTY to log in, make sure that the private key file has been converted to .ppk format.

1. Check whether the private key file has been converted to .ppk format.
   • If yes, go to step 7.
   • If no, go to step 2.
2. Visit the following website and download PuTTY and PuTTYgen:

   https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

   Note

   PuTTYgen is a key generator, which is used to create a key pair that consists of a public key and a private key for PuTTY.

3. Run PuTTYgen.
4. In the Actions pane, click Load and import the private key file that you stored during ECS creation.

   Ensure that the format of All files (*.*) is selected.

   Figure 1 Importing the private key file

   
   
5. In the Actions area, click Save private key.
6. Save the converted private key, for example, kp-123.ppk, to the local computer.
7. Double-click PUTTY.EXE. The PuTTY Configuration page is displayed.
8. Choose Session and enter the EIP of the ECS under Host Name (or IP address).

   Figure 2 Configuring the EIP

   
   
9. Choose Connection > Data. Enter the image username in Auto-login username.

   Figure 3 Entering the username

   
   
   Note

   When you log in to an ECS using an SSH key:

   • The image username is core for a CoreOS public image.
   • The image username is root for a non-CoreOS public image.
10. Choose Connection > SSH > Auth > Credentials. In the configuration item Private key file for authentication, click Browse and select the private key converted in step 6.

    Figure 4 Importing the private key file

    
    
11. Click Open to log in to the ECS.

Method 2: Use Xshell to log in to the ECS.

1. Start the Xshell tool.
2. Run the following command using the EIP to remotely log in to the ECS through SSH:

   ssh username@EIP

   Note

   When you log in to an ECS using an SSH key:

   • The image username is core for a CoreOS public image.
   • The image username is root for a non-CoreOS public image.
3. (Optional) If the system displays the SSH Security Warning dialog box, click Accept & Save.

   Figure 5 SSH Security Warning

   
   
4. Select Public Key and click Browse beside the user key text box.
5. In the user key dialog box, click Import.
6. Select the locally stored key file and click Open.
7. Click OK to log in to the ECS.

To log in to the Linux ECS from local Linux, perform the operations described in this section. The following operations use private key file kp-123.pem as an example to log in to the ECS. The name of your private key file may differ.

1. On the Linux CLI, run the following command to change operation permissions:

   chmod 400 /path/kp-123.pem

   Note

   In the preceding command, replace path with the actual path where the key file is saved.

2. Run the following command to log in to the ECS:

   ssh -i /path/kp-123.pem Default username@EIP

   For example, if the default username is root and the EIP is 123.123.123.123, run the following command:

   ssh -i /path/kp-123.pem root@123.123.123.123

   Note

   In the preceding command:

   • path refers to the path under which the key file is stored.
   • EIP is the EIP bound to the ECS.

• After logging in to the ECS using the SSH key, you can set a password (by using the passwd command) to log in to the Linux ECS using VNC.