How SSH keys work

SSH keys are the recommended way to reach your instances and training clusters in TIR. A key is far harder to guess than a password, and signing in with it keeps passwords off the network.

The key pair

An SSH key is a pair of keys that belong together.

Key	Where it lives	What it does
Private key	On your computer, kept to yourself	Proves who you are when you connect
Public key	Added to TIR and attached to your resources	Lets the resource check who you are

When you connect, the resource checks your private key against the public key it holds. If they match, you are signed in, with no password. Keep the private key on your computer; only the public key goes to TIR.

Where keys live in TIR

• Your keys belong to you, so the same list shows in every project.
• A key you have attached to an instance, a virtual machine, or a training cluster counts as in use. Take it off those resources before you delete it.
• When you create a key in the browser, its private half stays with you alone; TIR keeps only the public key. See Create a key in the browser.

Keep keys safe

• Use ed25519 or RSA 4096. Both are stronger than older key types. Set a passphrase on the private key.
• Run chmod 600 ~/.ssh/id_ed25519 on the private key. For a key made in the browser, run chmod 600 on the downloaded file before first use. Keep private keys out of cloud storage, shared drives, and version control.
• Give each key a name that says which computer it is for. Replace your keys with new ones from time to time, and delete old or unused keys from TIR.

To put this into practice, see Generate a key pair on your computer and Add an SSH key.