Connecting to Your Cloud Server With SSH

SSH gives you a root shell on your cloud server from your own terminal, and every detail you need to connect is shown on the server's page in KPanel, ready to copy.

A cloud server is yours from the operating system up, which means the command line is where most of the work happens. This guide covers finding your connection details, connecting with a key or a password, setting a key up properly, the browser console fallback, and the handful of errors that account for almost every failed connection.

Finding Your Connection Details

1. Sign in to KPanel.
2. Click Cloud Servers in the left sidebar, then click your server.
3. Find the Connection card.

The card holds three copy-to-clipboard fields:

Connecting With an SSH Key

If you pasted a public key into the SSH Public Key field when you ordered the server, key authentication is already configured and there is no password to type.

1. Copy the SSH Command from the Connection card.
2. Paste it into your terminal and press Enter.

ssh root@203.0.113.1

Your SSH client finds the matching private key and authenticates automatically. If your key lives somewhere non-standard, point at it explicitly:

ssh -i ~/.ssh/my-kapsule-key root@203.0.113.1

Setting Up a Key for the First Time

Generate a key pair on your own machine, not on the server:

ssh-keygen -t ed25519 -C "your-email@example.com"

Press Enter to accept the default location and set a passphrase when prompted. You now have two files:

• ~/.ssh/id_ed25519 is your private key. It never leaves your machine, and you never paste it anywhere.
• ~/.ssh/id_ed25519.pub is your public key. This is the one you give to servers.

Print the public key and copy the whole single line, including the ssh-ed25519 prefix and the trailing comment:

cat ~/.ssh/id_ed25519.pub

When you order a server, paste that line into the SSH Public Key field. The field's own hint says it plainly: "Paste your public key to enable key-based authentication. If left blank, a root password will be emailed to you."

To add a key to a server you already have, connect however you can today and append the public key line to /root/.ssh/authorized_keys.

Connecting With a Password

If you left the SSH Public Key field blank at order time, a root password is emailed to you once the server is provisioned.

1. Copy the SSH Command from the Connection card.
2. Paste it into your terminal and press Enter.
3. Enter the emailed root password at the prompt.

Change that password as soon as you are in, with passwd, and add an SSH key while you are there. An emailed password has travelled further than a credential should.

The Browser Console

The Browser console gives you a terminal inside KPanel, without an SSH client and without going through port 22. It is the tool for the moment your own access is the thing that broke.

1. Open the server's page and click Browser console in the action buttons, or go to /cloud-servers/<server-id>/console.
2. Click Start console. KPanel starts a terminal on the server behind HTTPS with one-time credentials.
3. The Username and Password are displayed on the page, with a Copy credentials button. The terminal opens in the page itself, and your browser may prompt you for those credentials.
4. Work as you would in any shell.

Use the console to undo a firewall rule that locked you out, reset a password, or repair sshd configuration. Once you are back in over SSH normally, you do not need it again.

Keeping SSH Access Safe

Port 22 is always open on a KapsuleHost server firewall, by design, so a firewall change can never lock you out of the machine entirely.

That means the security of your shell rests on how you authenticate, not on hiding the port. Two things do most of the work:

• Use keys, not passwords. Then a guessed password is not a way in.
• Leave fail2ban on. It is enabled by default and bans addresses that repeatedly fail SSH authentication. You can see the switch on the server's Management page.

Cloud Server Firewall and Security Management covers both, plus custom rules for the ports your own application needs.

Troubleshooting

"Connection refused." Nothing is listening. Check the server shows Running in KPanel, power it on if it is off, and use the browser console to check sshd is running.

"Connection timed out." Traffic is not arriving. Confirm you are using the IPv4 address from the Connection card, and check whether your own network blocks outbound port 22. A corporate or campus network sometimes does.

"Permission denied (publickey)." The server does not recognise your key. Confirm you pasted the .pub line, whole and unaltered, and that your client is offering the matching private key. Add -v to the ssh command to see which keys it tried.

"Permission denied, please try again" on a password. The password is wrong, or password authentication is disabled because you supplied a key. Use the key, or the browser console.

"REMOTE HOST IDENTIFICATION HAS CHANGED." The server's host key is different from the one your client remembers. This is expected after a rebuild, because the operating system was reinstalled. Remove the stale entry for that IP address from your known_hosts file and reconnect. If you have not rebuilt anything, stop and contact us before connecting.

I locked myself out with a firewall rule. Port 22 stays open, so this is unusual, but if a rule inside the server has blocked you, use the browser console to remove it.

If none of the above gets you a shell, email support@kapsulehost.com with the server name, the address you are connecting from, and the exact error text.