Adding and removing SSH keys on the server

The “Add SSH key” section on a server card shows which SSH keys the root user can log in with, and lets you add or remove keys without logging in to the server. You find it in the app.blackbox.md panel, on the “My Servers” page (app.blackbox.md/my-servers, left menu “Infrastructure” → “My Servers”). From blackbox.md, you can go straight to the card through “Contul meu” (My account) → “Comenzi” (Orders) → “Gestionează în app.blackbox.md” (Manage in app.blackbox.md).

Available to: the blackbox.md account holder who ordered the server, or an account that BLACKBOX has given management rights for the server. On cards marked “Managed”, the section does not appear; to request changes, write to us.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

The “Installed keys” list

1. On the server card, click “Add SSH key”. A section opens below the card's buttons; while the panel reads the data from the server, you see “Loading your keys…”.
2. The “Installed keys” list appears at the top: the keys from the server's /root/.ssh/authorized_keys file, one row per key.

Each row shows the beginning of the fingerprint (the first 20 characters, for example SHA256:Ab12Cd34Ef56G…), the key type (ssh-ed25519, ssh-rsa, etc.) and the key's comment:

On company servers where BLACKBOX has given you management rights, the “Management key (blackbox.md)” label, with no “Remove” button, appears on every key that you did not add yourself from the panel and that is not saved in your account. These keys cannot be removed from the panel.

To recognize your key, display its fingerprint on your computer and compare the beginning with the one in the list:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

On Windows (PowerShell):

ssh-keygen -lf $env:USERPROFILE\.ssh\id_ed25519.pub

If the file contains lines that the panel cannot read as keys, “{count} unreadable line(s) in authorized_keys were skipped.” appears below the list, with their number in place of {count}. Comment lines that start with # are counted too. These lines are not shown, and the panel does not change them.

How to add a key

You can install a key saved in your account (see SSH keys in your account (blackbox.md)) or paste any public key directly. If you don't have a key pair yet, follow Generating an SSH key (Windows, macOS, Linux).

1. On the server card, click “Add SSH key”.
2. Below “Installed keys”, choose one of the options:
   • “Use a saved key”, then the key you want from the “Select a key…” list; each entry shows the key's name and type;
   • “Paste a new key”, then paste a single line from the .pub file into the field (the empty field shows the example ssh-ed25519 AAAA... you@example.com).
3. Click “Add key”. The button becomes active once you have chosen or pasted a key; while the operation runs, it shows “Adding…”.
4. The result appears below the button:
   • “Key added.”: the key was written to the server;
   • “This key is already on the server.”: the same key was already in the file, even if it had a different comment; nothing changed.
5. The “Installed keys” list reloads and shows the new key.

The panel adds the key, with its comment, on a new line at the end of the /root/.ssh/authorized_keys file. Existing lines are not changed. If the .ssh directory or the file is missing, the panel creates them with the correct permissions.

• If you have no keys saved in your account, the “Use a saved key” option is inactive, and the section opens directly on “Paste a new key”.
• The list of saved keys loads only once, the first time you open the section. If you have added a key in “Contul meu” (My account) → “Chei SSH” (SSH keys) in the meantime, reload the “My Servers” page.
• A pasted key is installed only on this server and is not saved in your account.
• The accepted types are the same as in your account: ssh-ed25519, ssh-rsa (at least 2048 bits), ecdsa-sha2-nistp256/384/521 and sk-… hardware keys. Never paste your private key.

Then check, from a new terminal, that you can log in with the key, without a password (details in Connecting to your server over SSH (Windows, macOS, Linux)):

ssh -o PreferredAuthentications=publickey root@SERVER_IP

How to remove a key

1. On the server card, click “Add SSH key”.
2. In “Installed keys”, find the key by its fingerprint and comment, and click “Remove” on its row.
3. The browser asks you to confirm “Remove key SHA256:… from this server?”, with the beginning of the key's fingerprint after “Remove key”. Click “OK”. The button shows “Removing…”.
4. The result appears below the list:
   • “Key removed.”: the key was taken out of the file;
   • “That key wasn't installed.”: the key disappeared from the file while the operation was running; the panel changed nothing.

The panel removes only that key's line from /root/.ssh/authorized_keys; the other lines stay unchanged. The key stays saved in “Contul meu” (My account) → “Chei SSH” (SSH keys). Conversely, deleting a key from your account does not remove it from your servers: you remove it from each server here.

Warning Before you remove keys or disable password login, make sure that one of your keys stays installed on the server, and test logging in with it in a separate terminal while you keep your current session open. There is no web console: if you lose access, follow Lost access to your server (password or key).

Safeguards and messages

The panel refuses some risky removals, but it cannot protect you from every mistake: each time, check that you still have a key of your own. The messages appear in a red box below the list:

Technical errors and limits

When you add a key or load the list, some errors appear as a technical code or as a sentence in English:

The limits apply to your whole account, across all servers combined, and failed attempts count too:

The list loads every time you open the section and after every addition or removal. See also The “Too many attempts” message and usage limits and Panel error messages and what they mean.

If you see “SSH key management isn't available right now.” instead of the section, the feature is temporarily unavailable. Try again later; if the message persists, write to us.

Editing the authorized_keys file manually

You can also manage keys directly on the server, logged in as root. The panel reads the file every time you open the section, so it also sees manual changes.

1. Make a backup copy of the file:

   cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak

2. Display the fingerprints of all the keys in the file. Keys whose fingerprints start the same way as the “Management key (blackbox.md)” rows in the panel are management keys: do not touch them.

   ssh-keygen -lf ~/.ssh/authorized_keys

3. Open the file in an editor (nano or vi). Delete the whole line of the key you are removing; add a new key on a separate line at the end.

   nano ~/.ssh/authorized_keys

   If nano is not installed (this can happen on AlmaLinux and CentOS Stream), install it or use vi:

   dnf install -y nano

4. The change takes effect immediately, without restarting the SSH service. Test logging in from a new terminal before you close your current session. If something goes wrong, restore the copy:

   cp ~/.ssh/authorized_keys.bak ~/.ssh/authorized_keys

Important Never delete the management key's line. Without it, the “Installed keys” list, adding and removing keys, the password login buttons, commands through the AI assistant and, as a rule, “Reset password” stop working. Only support can put the key back. See BLACKBOX keys on your server.

Frequently asked questions

Why don't I see the name I gave the key in my account in “Installed keys”? The list shows the comment from the key's line (for example user@laptop), not the name from “Chei SSH” (SSH keys). Recognize the key by the beginning of its fingerprint.

Does the panel also manage the keys of users other than root? No. The list and the buttons work only with /root/.ssh/authorized_keys. For another user, edit the /home/USERNAME/.ssh/authorized_keys file manually; the steps are in Securing a new server: checklist.

I lost my private key, and the server is “Key-only”. What do I do? Generate a new key pair and add the new public key with “Paste a new key”: the panel installs it without needing the old key. Once you have logged in with the new key, remove the lost key from “Installed keys”. Other situations are covered in Lost access to your server (password or key).