> For the complete documentation index, see [llms.txt](https://docs.storware.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.storware.eu/deployment/first-steps-after-installation/ssh-public-key-authentication.md).

# SSH Public Key Authentication

## Overview

Storware Backup & Recovery supports public key authentication for connections that use SSH credentials, including hypervisors and application hosts.

The default private key path is:

```
/opt/vprotect/.ssh/id_rsa
```

You can specify a different path in the relevant SSH credentials settings. The private key must be accessible on the Node executing the connection, owned by `vprotect`, and have permissions set to `0400`.

> **Supported key type:** RSA. Generate the private key in PEM format.

## Preparing and depolying keys

### 1. Prepare the SSH Directory

Run the following commands as `root` on the Storware Backup & Recovery Node:

```
install -d -m 700 -o vprotect -g vprotect /opt/vprotect/.ssh
```

### 2. Generate or Import a Key

Generate an RSA key pair as the `vprotect` user:

```
sudo -u vprotect ssh-keygen \
  -t rsa \
  -m PEM \
  -f /opt/vprotect/.ssh/id_rsa
```

When prompted, enter a passphrase or leave it empty to create an unencrypted private key. Do not overwrite an existing key used by other connections.

Alternatively, place an existing RSA private key and its corresponding public key at:

```
/opt/vprotect/.ssh/id_rsa
/opt/vprotect/.ssh/id_rsa.pub
```

Set ownership and permissions:

```
chown vprotect:vprotect \
  /opt/vprotect/.ssh/id_rsa \
  /opt/vprotect/.ssh/id_rsa.pub

chmod 400 /opt/vprotect/.ssh/id_rsa
chmod 644 /opt/vprotect/.ssh/id_rsa.pub
```

### 3. Install the Public Key on the Target Host

Replace `SSH_USER` with the remote account used by Storware Backup & Recovery and `TARGET_HOST` with the target hostname or IP address:

```
sudo -u vprotect ssh-copy-id \
  -i /opt/vprotect/.ssh/id_rsa.pub \
  SSH_USER@TARGET_HOST
```

Verify the target host’s SSH fingerprint when prompted. Enter the remote account’s password to install the public key.

The remote account must have the permissions required by the selected integration.

### 4. Verify Authentication

Test the connection as the local `vprotect` user:

```
sudo -u vprotect ssh \
  -o PreferredAuthentications=publickey \
  -i /opt/vprotect/.ssh/id_rsa \
  SSH_USER@TARGET_HOST
```

The connection should succeed without requesting the remote account’s password. An encrypted private key may still require its passphrase.

Exit the remote session:

```
exit
```

### 5. Configure Credentials in Storware Backup & Recovery

In the SSH credentials settings for the protected resource:

1. Select public key authentication.
2. Enter the remote SSH username.
3. Specify the private key path, such as `/opt/vprotect/.ssh/id_rsa`.
4. Enter the private key passphrase if the key is encrypted. Otherwise, leave the passphrase empty.
5. Save the configuration and verify the connection by running inventory synchronization or the appropriate operation for the integration.

If multiple Nodes can connect to the resource, configure a usable private key and corresponding remote authorization for each participating Node.