🔐 Generate a dedicated key for Hand. Never share private keys in a chat or commit them to Git. The current Hand version accepts an unencrypted private key file and encrypts it in its database.
1. Check for existing local SSH keys
Open PowerShell on your own computer. Files ending in .pub are public; their matching files without .pub are private.
Get-ChildItem "$HOME\.ssh" -Force -ErrorAction SilentlyContinue
2. Create a new dedicated Ed25519 key if needed
The private key will be hand_ed25519; the public key will be hand_ed25519.pub. When prompted for a passphrase, press Enter for this initial Hand version.
New-Item -ItemType Directory -Force "$HOME\.ssh" | Out-Null
ssh-keygen -t ed25519 -f "$HOME\.ssh\hand_ed25519" -C "hand-access"
3. View the public key to authorize on the server
Get-Content "$HOME\.ssh\hand_ed25519.pub"
1. Check for existing local SSH keys
Run on your own Linux/macOS workstation. A .pub file is public; its matching file without .pub is private.
ls -lah ~/.ssh
2. Create a new dedicated Ed25519 key if needed
Use a dedicated identity, not your main SSH key. Press Enter for an empty passphrase for this MVP (it will be encrypted by Hand).
mkdir -p ~/.ssh && chmod 700 ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/hand_ed25519 -C "hand-access"
3. View the public key
cat ~/.ssh/hand_ed25519.pub
4. Check whether the Ubuntu server has SSH enabled
Run these on the target server through an existing SSH session or your hosting provider's console:
sudo systemctl status ssh
sudo ss -ltnp | grep ':22'
If the SSH server is not installed, install and enable it from the provider console. Verify its port and firewall rules before connecting:
sudo apt-get update
sudo apt-get install -y openssh-server
sudo systemctl enable --now ssh
5. Authorize the public key on the target server
Use an existing non-root SSH account, or create one with sudo adduser handops. Paste only the contents of hand_ed25519.pub into that account's ~/.ssh/authorized_keys using a trusted server console, then run the following as that account:
mkdir -p ~/.ssh && chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
Set the form's Username field to that remote account. Test an SSH connection from your workstation before saving the host in Hand.
6. Obtain the server's real host-key fingerprint
Run on the target server itself (or its trusted provider console). Do not confuse the server host key with your personal user key.
sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub -E sha256
Copy only the SHA256:... value into Host key fingerprint. Verify it independently; do not trust an unverified network scan as your only source.
7. Import the dedicated private key into Hand
Choose hand_ed25519 (without .pub) on your own computer using the file picker below. Never select the host's /etc/ssh/ssh_host_* private keys.