Use SSH keys

A key pair lets you log in without typing a password: the private key stays in Sternway’s Keychain, encrypted, and the public key goes into the server’s ~/.ssh/authorized_keys. Keys live in the Keychain on both the desktop and the phone.

Generate a key

1. Open Keychain › Keys and choose Generate.
2. Pick the Type. Ed25519 is the right choice for almost every server. Choose RSA (2048, 3072 or 4096 bits) or ECDSA only for a server that demands it, and the security key types only with a FIDO2 key (Log in with a hardware security key).
3. Give it a Label and, if you like, a Comment (the comment ends up in authorized_keys and helps you recognise the key there).
4. Optionally set a Passphrase. The key is already stored encrypted by Sternway; a passphrase adds a second lock that you type when the key is used.
5. Choose Generate.

Import a key you already have

1. Open Keychain › Keys and choose Import.
2. Choose the private key file, or paste it whole, including its BEGIN and END lines. OpenSSH keys, PEM keys (PKCS#1, PKCS#8, SEC1) and PuTTY .ppk files are accepted; a .ppk is converted to OpenSSH.
3. If the key is encrypted, type its Passphrase. The desktop app does not keep it and asks each time the key is used; the phone saves it with the key, so the key then works without asking.

An OpenSSH certificate that belongs to the key is attached separately, under Keychain › Certificates (Use SSH certificates).

Put the public key on a server

Sternway can add the key to a server for you:

1. On the host’s ⋯ menu choose Install a key… (or, on the key’s page, Install on host…).
2. Pick the Key and the Hosts, and choose Install.

Sternway logs in to each host the usual way (with its password, once), creates ~/.ssh and authorized_keys when they are missing, and appends one line. Nothing already in the file is changed, and a key that is already there is not added again. Each host reports Added to ~/.ssh/authorized_keys or Already present.

To do it by hand instead, copy the line shown under Public key on the key’s page (or Save as .pub…) into the server’s ~/.ssh/authorized_keys.

Make a host log in with the key

After an install, the result offers Use this key for (host), which sets the host’s Key. Or open the host’s editor, pick the key under Login › Key, and save. With a key set, Sternway offers it first and falls back to the password only if the server refuses it.

Share one login between hosts: identities

An identity is a user name with a password or a key, saved once and used by many hosts.

1. Open Keychain › Identities and create one: a Label, the Username, and a Key or Password.
2. In each host’s editor, pick it under Login › Identity.

Changing the identity’s key later changes it for every host that uses it. When you install a key on a host that logs in through an identity, Sternway asks whether to change the identity or only that host.

Export a key

On the key’s page, export the private key to a file. For a key without a passphrase of its own, Sternway offers to encrypt the exported copy with one; without it, anyone who gets the file can log in as you.

Notes

• Keys, identities and certificates sync to your other devices, encrypted, unless you turn off Settings › Security › Sync keys and identities. Then they stay on the device where you made them.
• A team can require keys instead of passwords for its hosts (Team policies).
• The Hardware keys tab is for keys kept in the computer’s own secure hardware. No platform’s hardware is supported yet, so it says so; for a key that cannot be copied, use a FIDO2 security key.
• Every field: Keychain.