# add SSH key after provisioning to production device?

**URL:** <https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886>\
**Category:** balenaOS\
**Tags:** ssh\
**Created:** [January 11, 2022, 9:12pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886 "2022-01-11T21:12:19Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [January 11, 2022, 9:12pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/1 "2022-01-11T21:12:19Z")

</div>

Hello,  
I’m really lost and doubt that it is even possible at all.

I have already read through [Adding SSH key after flashing - Product support / balenaOS - balenaForums](https://forums.balena.io/t/adding-ssh-key-after-flashing/23905) and followed [Unable to add SSH key - Product support - balenaForums](https://forums.balena.io/t/unable-to-add-ssh-key/350024) but I have not been able to ssh into my device.

Is any [public added to](https://www.balena.io/docs/learn/manage/ssh-access/#add-an-ssh-key-to-balenacloud) pushed to the devices automatically or is any action of the admin necessary?

Where does `balena-cli\bin>balena ssh <uuid>` expect the `PuTTY key > OpenSSH key` to be stored as the `-i` flag is not working in the CLI?  
I run `--verbose` what reveals that only `%USERPROFILE%/.ssh/` is checked for the `identity file`.  
Moreover, I see

```auto
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2

```

My CLI runs on Windows 10.

Could anyone tell me how to proceed?  
I read:

1. [balena-io/balena-cli-masterclass: A guide to getting started with the balena CLI (github.com)](https://github.com/balena-io/balena-cli-masterclass) which does not tell how the key finds it way into the device
2. [balena-os/configizer: Safe(r) balenaOS config.json updates remotely (github.com)](https://github.com/balena-os/configizer) which seems only possible with existing ssh connection.
  1. Moreover, I have to use `push` to get the files into the device, don’t I?

3. [balena CLI Documentation - Balena Documentation](https://www.balena.io/docs/reference/balena-cli/) but could not find an option to modify the config of a running device `config` works against an image only (seems to me so).
4. [balena-io-playground/ssh-key-insert: Tooling to insert the relevant SSH keys into balena devices’ configuration. (github.com)](https://github.com/balena-io-playground/ssh-key-insert) leaves me clueless that might be the solution but it cannot only be executed on Linux (or Windows Subsystem for Linux), can it?

In the end I want to finish [how to import proxy server certificates into CLI and OS? - Product support / balenaOS - balenaForums](https://forums.balena.io/t/how-to-import-proxy-server-certificates-into-cli-and-os/350818)

thank you for enlightening me in my desperation  
stefan

---

<div class="post-metadata">

**Author:** ![Hades32](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/hades32/32/6430_2.png) [@Hades32](https://forums.balena.io/u/Hades32)\
**Post date:** [January 14, 2022, 2:01pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/3 "2022-01-14T14:01:00Z")

</div>

Hello there,

SSH and balenaOS works like this:

- balenaOS trust one SSH key by default: The key from balena cloud
  - when you connect via the web-dashboard, this is used to connect
  - when you use `balena ssh DEVICE_UUID` your own ssh key is used to connect to the cloud and the cloud uses its key to connect to the device

- when you use `balena ssh LOCAL_IP_OF_DEVICE` we assume it’s in development mode (actually not 100% sure on that, need to re-check) which means no key is needed at all
- you can add an extra trusted ssh certificate in `config.json`, this will allow you to connect via `ssh -p 22222 root@LOCAL_IP_OF_DEVICE`, this is mostly useful of you need offline access
- you can ssh to a device, which is online via `ssh -p 22222 YOUR_CLOUD_USERNAME@LOCAL_IP_OF_DEVICE`
  - here the device temporarily downloads ssh key that you have configured in balenaCloud and checks your local key against it

Neither of these has anything to do with the `balenaRootCA` key in `config.json` which you mention in your other forum post. That one changes which certificates we trust when doing HTTPS (TLS) communication with balenaCloud and is most commonly changed when you have an intercepting (corporate) proxy in the middle.

Hope this clarifies things a bit.

Cheers,  
Martin

PS: Windows 10 has the original `ssh` included nowadays. If you have issues with Putty, you can use that

---

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [January 14, 2022, 5:21pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/6 "2022-01-14T17:21:16Z")

</div>

thx for the update

> [@Hades32](#):
>
> Neither of these has anything to do with the `balenaRootCA` key in `config.json` which you mention in your other forum post.

it is related in such a sense, that I have to ssh into the image to install the CA, that is the background why I started doing it.

> [@Hades32](#):
>
> Hope this clarifies things a bit.

it helps 🙂 a bit

does the above mentioned apply to the productive image as well as it is stated in [What is balenaOS? - Balena Documentation](https://www.balena.io/docs/reference/OS/overview/2.x/)

> Production images disable passwordless root access, and an SSH key must be [added](https://www.balena.io/docs/reference/OS/configuration/#sshkeys) to `config.json` to access a production image using a direct SSH connection.  
> I’m wondering how to do this.  
> Currently I see only two options:

1. [balena-io-playground/ssh-key-insert: Tooling to insert the relevant SSH keys into balena devices’ configuration. (github.com)](https://github.com/balena-io-playground/ssh-key-insert) but currently battling WSL to make it work with the proxy (in the end it is a repeat of what has to be done to make balena-cli work with the proxy)
2. doing all through the web terminal (which prone to errors)

I know that you can add [public SSH key](https://www.balena.io/docs/learn/manage/ssh-access/#add-an-ssh-key-to-balenacloud) to the cloud but no clue how that makes its way to the device ❓

---

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [January 20, 2022, 8:16pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/7 "2022-01-20T20:16:11Z")

</div>

@Hades32 I got WSL2 up and balena-cli running in it, see [How-To: How install balena-cli in WSL2 if behind Proxy like Zscaler - Product support / balenaOS - balenaForums](https://forums.balena.io/t/how-to-how-install-balena-cli-in-wsl2-if-behind-proxy-like-zscaler/350969).  
I tried now [balena-io-playground/ssh-key-insert: Tooling to insert the relevant SSH keys into balena devices’ configuration. (github.com)](https://github.com/balena-io-playground/ssh-key-insert) but I get

```auto
:~/balena.io/ssh-key-insert-master$ bash -x ./run.sh
+ cat batch
+ stdbuf -oL xargs '-I{}' -P 10 /bin/sh -c 'grep -a -q '\''{} : DONE'\'' sshkey.log || (cat add-ssh-key.sh | balena ssh {} | sed '\''s/^/{} : /'\'' | tee --append sshkey.log)'
<usedr-name>@ssh.balena-devices.com: Permission denied (publickey).
Warning: ssh process exited with non-zero code "255"

Are the SSH keys correctly configured in balenaCloud? See:
https://www.balena.io/docs/learn/manage/ssh-access/#add-an-ssh-key-to-balenacloud
Are you accidentally using `sudo`?

```

I’m still clueless about which key is expected for what action and how keys are distributed…?

---

<div class="post-metadata">

**Author:** ![Hades32](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/hades32/32/6430_2.png) [@Hades32](https://forums.balena.io/u/Hades32)\
**Post date:** [January 24, 2022, 1:28pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/8 "2022-01-24T13:28:25Z")

</div>

You don’t have to SSH into the device to install the CA. You just add it into `config.json` as part of provisioning: [meta-balena/README.md](https://github.com/balena-os/meta-balena/blob/8999dafa010c8ce6a89ca3368e7d1a20ae4c5c46/README.md#balenarootca)

And if you really have to add ssh keys - which I don’t think you need - the same docs show you how: [meta-balena/README.md](https://github.com/balena-os/meta-balena/blob/8999dafa010c8ce6a89ca3368e7d1a20ae4c5c46/README.md#sshkeys)

---

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [January 24, 2022, 2:37pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/9 "2022-01-24T14:37:24Z")

</div>

> [@Hades32](#):
>
> You just add it into `config.json` as part of provisioning: [meta-balena/README.md](https://github.com/balena-os/meta-balena/blob/8999dafa010c8ce6a89ca3368e7d1a20ae4c5c46/README.md#balenarootca)

but what if I forgot to do so?

> [@Hades32](#):
>
> And if you really have to add ssh keys - which I don’t think you need - the same docs show you how: [meta-balena/README.md](https://github.com/balena-os/meta-balena/blob/8999dafa010c8ce6a89ca3368e7d1a20ae4c5c46/README.md#sshkeys)

that is what I’m trying using [balena-io-playground/ssh-key-insert: Tooling to insert the relevant SSH keys into balena devices’ configuration. (github.com)](https://github.com/balena-io-playground/ssh-key-insert) but I’m bit clueless here [how is the SSH key added to balenaCloud used? - Product support - balenaForums](https://forums.balena.io/t/how-is-the-ssh-key-added-to-balenacloud-used/351019/2) 🙂

---

<div class="post-metadata">

**Author:** ![pdcastro](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/pdcastro/32/1264_2.png) [@pdcastro](https://forums.balena.io/u/pdcastro)\
**Post date:** [January 28, 2022, 6:15pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/10 "2022-01-28T18:15:15Z")

</div>

@PackElend, I can confirm that `balena ssh <device-UUID>` does **not** require adding a public ssh key to a device’s `config.json` file (regardless of whether it is running a production or development image of balenaOS), as long as the device can access balenaCloud (i.e. the device has access to the internet and no firewall is blocking its access to `*.balena-cloud.com`).

You should **not** need to use the `ssh-key-insert` script in order to use `balena ssh <device-UUID>`.

> Where does `balena-cli\bin>balena ssh <uuid>` expect the `PuTTY key > OpenSSH key` to be stored as the `-i` flag is not working in the CLI?

I understand that PuTTY store SSH keys in the Windows Registry, but the balena CLI does **not** look for keys in the Windows Registry, and in this sense it is not compatible with PuTTY. (There may be a way of making it work with PuTTY, but it is not a documented/supported scenario.)

The balena CLI assumes the use of Microsoft’s built-in ssh client that ships with Windows 10 or later. (Microsoft introduced the built-in ssh client through a Windows 10 maintenance update in year 2018.)

> I run `--verbose` what reveals that only `%USERPROFILE%/.ssh/` is checked for the `identity file` .

Exactly. Your public and private ssh keys should be in that directory.

Here’s an example of how to generate the keys using PowerShell.

Confirm that `ssh`, `ssh-keygen`, `ssh-add` and `ssh-agent` are the Microsoft built-ins, rather than PuTTY’s:

```plaintext
PS C:\Users\paulo> Get-Command ssh | Format-Table -AutoSize
PS C:\Users\paulo> Get-Command ssh-add | Format-Table -AutoSize
PS C:\Users\paulo> Get-Command ssh-agent | Format-Table -AutoSize
PS C:\Users\paulo> Get-Command ssh-keygen | Format-Table -AutoSize

CommandType Name Version Source
----------- ---- ------- ------
Application ssh.exe 8.1.0.1 C:\WINDOWS\System32\OpenSSH\ssh.exe
Application ssh-add.exe 8.1.0.1 C:\WINDOWS\System32\OpenSSH\ssh-add.exe
Application ssh-agent.exe 8.1.0.1 C:\WINDOWS\System32\OpenSSH\ssh-agent.exe
Application ssh-keygen.exe 8.1.0.1 C:\WINDOWS\System32\OpenSSH\ssh-keygen.exe

```

Generate a public/private key pair as follows. The most widely recommended key type nowadays appears to be Ed25519 (e.g. [Microsoft guide](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement#user-key-generation) and [GitHub guide](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent)) as RSA is increasingly considered less secure, so:

```plaintext
PS C:\Users\paulo> ssh-keygen -t ed25519
Generating public/private ed25519 key pair.
Enter file in which to save the key (C:\Users\paulo/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in C:\Users\paulo/.ssh/id_ed25519.
Your public key has been saved in C:\Users\paulo/.ssh/id_ed25519.pub.
The key fingerprint is: ...

PS C:\Users\paulo> dir C:\Users\paulo\.ssh\
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 28/01/2022 16:39 464 id_ed25519
-a---- 28/01/2022 16:39 104 id_ed25519.pub

PS C:\Users\paulo> type .\.ssh\id_ed25519.pub
ssh-ed25519 AAA... paulo@DESKTOP-3021L0B

```

Now copy the public key component (contents of the `id_ed25519.pub` file – output of the `type` command above) to the balenaCloud web dashboard: Preferences → SSH Keys → Add a new SSH key → Add key manually. (The contents of the Title field are just for your own reference and not used by the balena CLI.)

**Something to double check:** Ensure that you are using the same balenaCloud account (same username) when logging in to the web dashboard and when logging in to the balena CLI. Find the web dashboard username by clicking on your name at the top-right corner of the window – this raises a pop-up menu that shows the username. Check that the username matches against the output of the CLI’s `balena whoami` command.

_Note re private key passphrase:_  
When `ssh-keygen` prompts you for a passphrase, it is good security practice to set one (not leaving it blank). Then, for convenience, to avoid having to type the private key’s passphrase every time you run `balena ssh`, run the `ssh-agent` service as per [Microsoft’s guide](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement#user-key-generation). That is:

On a PowerShell prompt [opened as Administrator](https://www.howtogeek.com/742916/how-to-open-windows-powershell-as-an-admin-in-windows-10/):

```auto
PS C:\WINDOWS\system32> Get-Service ssh-agent | Set-Service -StartupType Manual
PS C:\WINDOWS\system32> Start-Service ssh-agent
PS C:\WINDOWS\system32> Get-Service ssh-agent

Status Name DisplayName
------ ---- -----------
Running ssh-agent OpenSSH Authentication Agent

```

On a PowerShell prompt opened as regular user:

```auto
PS C:\Users\paulo> ssh-add
Enter passphrase for C:\Users\paulo/.ssh/id_ed25519:
Identity added: C:\Users\paulo/.ssh/id_ed25519 (paulo@DESKTOP-3021L0B)

PS C:\Users\paulo> balena ssh aab9ad....
=============================================================
    Welcome to balenaOS
=============================================================
root@aab9ad3:~#

```

You should then only need to re-enter the passphrase when the workstation is rebooted.

Finally, regarding the following debugging output:

> debug3: Failed to open file:C:/ProgramData/ssh/ssh\_known\_hosts error:2  
> debug3: Failed to open file:C:/ProgramData/ssh/ssh\_known\_hosts2 error:2

It is normal, not a problem. ssh’s debugging output seems to use the word “failed” whenever some configuration file doesn’t exist, even when harmless.

---

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [January 28, 2022, 6:36pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/11 "2022-01-28T18:36:35Z")

</div>

Wow that is comprehensive answer 🙂  
I’m currently away, will check as soon as I am back

---

<div class="post-metadata">

**Author:** ![pdcastro](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/pdcastro/32/1264_2.png) [@pdcastro](https://forums.balena.io/u/pdcastro)\
**Post date:** [March 21, 2022, 4:09pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/12 "2022-03-21T16:09:58Z")

</div>

@PackElend, were you able to get `balena ssh` to work? For your information, `balena ssh` improvements were made in balena CLI version 13.3.0 or later, such that even when using the **IP address** of a **production** balenaOS device as the ssh target, it is **not** necessary to add a ssh key to the `config.json` file. The ssh documentation on balena’s website was updated as well: [SSH access - Balena Documentation](https://www.balena.io/docs/learn/manage/ssh-access/#using-balena-ssh-from-the-cli)

PuTTY is still not supported though, and the instructions in my previous answer still apply.

---

<div class="post-metadata">

**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\
**Post date:** [March 23, 2022, 5:09pm UTC](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/14 "2022-03-23T17:09:14Z")

</div>

to be honest I had to pause this as I was forced to change priorities.

it is still on my agenda. I hope I can make up some hours in April as I would like to use it for testing containerized SysLog-Application locally