Connecting to your server over SSH (Windows, macOS, Linux)

You manage your server over SSH: you connect from a terminal (macOS, Linux, Windows) or from PuTTY and work directly on the server's command line. You'll find the connection details in the app.blackbox.md panel, under “My Servers” (app.blackbox.md/my-servers; from blackbox.md: “Contul meu” (My account) → “Panou de administrare” (Admin panel) → “My Servers”), and in the email with the subject “Serverul dvs. este gata — BBX-…” (Your server is ready — BBX-…).

Available to: the blackbox.md account holder with an active VPS server. Dedicated servers are prepared manually by our team, and you agree on their access details with us.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

What you need

The badge next to the server name on the card shows the login method: “Password + key” (both the password and the installed keys work) or “Key-only” (only keys work). You choose the method when you order (The SSH key at order time and “key-only” servers) and can change it later from the panel (Enabling and disabling SSH password login).

Note The “Serverul dvs. este gata” (Your server is ready) email may arrive about a minute before the server responds over SSH. If your first attempt fails, wait a minute and try again.

Connecting from macOS and Linux

The SSH client is already installed.

1. Open the Terminal app. On macOS: press Cmd + Space, type “Terminal” and press Enter. On Linux: open it from the applications menu (on Ubuntu, Ctrl + Alt + T).

2. Run the command, replacing SERVER_IP with the server's address:

   ssh root@SERVER_IP

3. On the first connection, SSH shows you the server's fingerprint and asks whether you trust it:

   The authenticity of host 'SERVER_IP (SERVER_IP)' can't be established.
   ED25519 key fingerprint is SHA256:….
   Are you sure you want to continue connecting (yes/no/[fingerprint])?

   Type yes and press Enter. The fingerprint is saved in ~/.ssh/known_hosts, and the question won't appear again.

4. Enter the password and press Enter. The password does not appear on the screen while you type it, not even as asterisks: this is normal. On a “Key-only” server, you are not asked for a password: if the key is accepted, you go straight in (if the key has a passphrase, you are asked for the passphrase).

5. When the server's command line appears, ending in #, you are connected as root. End the session with Ctrl + D.

With a specific key

To choose the key explicitly (for example, when you have several), write the path to the private key after -i, that is, the file without .pub:

ssh -i ~/.ssh/id_ed25519 root@SERVER_IP

If SSH shows WARNING: UNPROTECTED PRIVATE KEY FILE! and ignores the key, the file's permissions are too broad. Restrict them:

chmod 600 ~/.ssh/id_ed25519

How to create a key: Generating an SSH key (Windows, macOS, Linux).

Connecting from Windows 10 and 11

PowerShell or Windows Terminal

Windows 10 and 11 include the OpenSSH client, so the commands are the same as on macOS and Linux.

1. Open PowerShell or Windows Terminal (Start menu → type “PowerShell”).

2. Run:

   ssh root@SERVER_IP

3. On the first connection, confirm the fingerprint with yes, then enter the password, as described above.

With a specific key (your keys are in the .ssh folder of your profile, C:\Users\USERNAME\.ssh):

ssh -i $env:USERPROFILE\.ssh\id_ed25519 root@SERVER_IP

If Windows says that ssh is not recognized as a command, add the OpenSSH Client component in Windows Settings, under optional features.

PuTTY

PuTTY is a free SSH client with a graphical interface. Download it from the official PuTTY website.

1. Open PuTTY. In the “Session” category, fill in:
   • “Host Name (or IP address)”: the server's IP address;
   • “Port”: 22;
   • “Connection type”: “SSH”.
2. Optionally, under “Connection” → “Data”, enter root in the “Auto-login username” field.
3. For key authentication, open “Connection” → “SSH” → “Auth” → “Credentials”, click “Browse...” next to “Private key file for authentication” and choose the .ppk file (see below). In older versions of PuTTY, this field is directly under “Auth”.
4. Click “Open”. On the first connection, the “PuTTY Security Alert” window appears with the server's fingerprint: click “Accept”.
5. At “login as:”, type root (if you didn't fill it in at step 2), then the password. The password does not appear on the screen.

The key for PuTTY: the .ppk format

PuTTY can't read OpenSSH keys (for example id_ed25519) directly; it needs the .ppk format. You convert the key with PuTTYgen, which is installed together with PuTTY:

1. Open PuTTYgen and click “Load”.
2. In the file selection window, choose the “All Files (*.*)” filter and open the private key (for example C:\Users\USERNAME\.ssh\id_ed25519, the file without .pub).
3. If the key has a passphrase, enter it.
4. Click “Save private key” and save the .ppk file. This is the file you choose in PuTTY at step 3.

If you generated the key directly in PuTTYgen, you already have the .ppk file.

A port other than 22

On BLACKBOX servers, SSH listens on port 22. If you moved SSH to another port yourself, specify it with -p (in PuTTY, in the “Port” field):

ssh -p PORT root@SERVER_IP

The network filtering managed by BLACKBOX lets through only SSH (22), HTTP (80), HTTPS (443) and ping by default, and the panel also connects to the server on port 22 (for “Reset password”, SSH keys and password login). On another port, SSH may be unreachable from the internet, and these buttons stop working. Write to support before you make the change: How to contact BLACKBOX support. Details: Firewall: network filtering and ufw/firewalld on the server.

The “REMOTE HOST IDENTIFICATION HAS CHANGED” warning

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
…
Host key verification failed.

During an earlier connection, your computer saved a different fingerprint for this IP address. This happens when the server was recreated or its system was reinstalled, or when the IP address belonged to another server you connected to before. SSH refuses to connect until you delete the old fingerprint.

1. Delete the old fingerprint (the command also works in PowerShell):

   ssh-keygen -R SERVER_IP

2. Connect again and confirm the new fingerprint with yes.

In PuTTY, the “PuTTY Security Alert” window appears, warning that the server's key does not match the saved one. If you know why it changed, click “Accept” (“Yes” in older versions).

Warning If the server was not recreated or reinstalled and the IP address has not changed, do not continue connecting, and write to support: How to contact BLACKBOX support. A fingerprint that changed for no reason may mean that someone is intercepting the connection.

“Key-only” servers

On a server with the “Key-only” badge, SSH does not ask for a password: without the correct key, you get Permission denied (publickey).

• The root password exists (you can see it with “Reveal credentials”), but it works over SSH only after you click “Enable password login”: Enabling and disabling SSH password login.
• To add a new key (for example, from another computer), use “Add SSH key”: Adding and removing SSH keys on the server.
• If you lost the private key: Lost access to your server (password or key).

Common errors on the first connection

All cases, with step-by-step checks: I can't connect over SSH.

There is no browser console

Customers have no web or VNC console (not even the one mentioned in the email for “Key-only” servers): you manage the server over SSH. From the panel, without connecting, you can reboot, stop and start the server, reset the root password and manage keys (the last two require SSH to be working on the server): The “My Servers” page: the server card. If you can't connect and the panel buttons don't help: Lost access to your server (password or key).

After your first connection

Change the password from the email or switch to keys

• New password: on the server card, click “Reset password”. The panel sets a new password and remembers it, so “Reveal credentials” shows the correct password: Resetting the root password. If you change the password with passwd, the panel will keep showing the old one.
• SSH keys: add your key with “Add SSH key”, check in a second terminal that you can connect with it, and only then click “Disable password login”.

Update the system

Ubuntu and Debian:

apt update
apt upgrade -y

On Ubuntu, a needrestart window may appear asking which services to restart: keep the suggested selection and press Enter.

AlmaLinux and CentOS Stream:

dnf upgrade -y

If the kernel was updated, reboot the server with “Reboot” in the panel. Automatic updates: System updates and automatic security updates.

Important When you change SSH settings or the firewall, keep a second SSH session open until you've checked that you can connect again. If you lose access, write to support.

Next steps: Securing a new server: checklist.

Frequently asked questions

The email for a “Key-only” server shows “Amprente chei” (Key fingerprints). Should they match the fingerprint I see on the first connection? No. The email lists the fingerprints of your public keys, the ones attached to the order. On the first connection, SSH shows the server's fingerprint, which is a different one. To see your key's fingerprint, run the command below and compare the result with the one in the email.

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Can I connect as a user other than root? The access details from BLACKBOX (the password and the keys from the order) are for root. You can create other users on the server yourself.

How do I copy files to the server? Also over SSH, with scp, rsync or an SFTP client: Transferring files to the server (scp, rsync, SFTP).