Add an SSH credential

3 min · Screen: /credentials · Needs: Permissions.Credentials.Create

1. Open Infrastructure › SSH credentials and click New credential

2. Name it and enter the user name

   Use a dedicated account such as bmp-backup - never root. The server’s onboarding script creates this account for you.

3. Choose the authentication

   • Private key (preferred): paste an OpenSSH or PEM key - Ed25519, ECDSA, or RSA of at least 3072 bits. If it has a passphrase, enter it now: the key is checked before it is stored.

   • Password: type it once.

4. Optionally limit it to some servers and set the rotation date

   Allowed servers left empty means any server may use it. Rotation due defaults to 180 days from today.

5. Save

   From now on the list shows only the key’s fingerprint, never the key or password.

Caution

Stored secrets are write-only. To change one use Replace material or Rotate - nobody, not even an administrator, can read it back.

Look after credentials

Rotate

Rotate moves every server that uses the credential to new material in one step. You are reminded before the due date.

Replace material

Swap the key or password of the same credential, e.g. after a leak.

Used by

The list shows which servers use each credential. A credential in use cannot be deleted.

Tip

One credential per environment (for example bmp-prod, bmp-staging) keeps a leaked key from opening every server.

Related

• Add a server
• Roles and permissions
• Fix common problems