SSH keys: manage secure access without sharing the primary password

SSH access can permit powerful account-level operations. The provider must enable the appropriate access first. An authorised key may allow a user to change files and run commands far beyond a single webpage.

Establish access deliberately

1. Confirm who needs access and whether a narrower deployment or file-transfer method would suffice.
2. Create the key on a trusted device and protect its private half with a passphrase where supported.
3. Import only the public key into the server’s supported key-management interface and authorise it intentionally.
4. Confirm the server fingerprint using a trusted provider channel before the first connection.
5. Test the allowed access and record the key’s owner and purpose.

Keep private material private

Do not upload or email a private key as a convenience. Do not commit keys to Git. A public key can be shared for enrolment, but authorising it grants access and should be limited to the intended person or service.

Review authorised keys periodically and revoke obsolete ones after contractor work or device loss. Account-level shell access is not a substitute for isolated deployment identities where those are available. Keep logs and backups, and do not paste commands into Terminal without understanding their paths and effects.