Connecting to your server

There are two ways to access your BareMeta server — the browser terminal (quickest, no setup required) or SSH from your local machine (more powerful, recommended for regular use). If your server has no public IP, you can still use your own terminal by joining the VPN first.

Option 1 — Browser terminal

The fastest way to get into your server. No software to install, works from any browser.

1. Go to Virtual Machines in the dashboard
2. Find your server and click the SSH button
3. A terminal opens in your browser — you're in

You'll be logged in as ubuntu on Ubuntu servers. The browser terminal is fully functional — you can install software, edit files, and run any commands you'd normally run over SSH.

Option 2 — SSH from your local machine

SSH (Secure Shell) is the standard way to access remote Linux servers. It gives you a faster, more reliable connection and lets you do things like transfer files.

What you need

• macOS / Linux — SSH is built in. Open Terminal and you're ready.
• Windows — Use Windows Terminal, PowerShell, or PuTTY. Windows 10/11 has SSH built in.

Find your server's IP address

Click the 📡 IP button on your server row in the dashboard. If the server has a public IP assigned, use that address for SSH from your local terminal. If only a private IP is shown, connect from the browser console or over the VPN instead.

Connect

Open a terminal and run:

ssh USERNAME@YOUR_SERVER_IP

Replace YOUR_SERVER_IP with your server's actual IP address. The first time you connect, you'll see a message about the server's fingerprint — type yes to continue.

The username depends on the OS you picked:

• Ubuntu → ubuntu
• Debian → debian
• Rocky Linux → rocky
• AlmaLinux → almalinux
• Fedora → fedora
• Ubuntu marketplace images such as Docker, PostgreSQL, and k3s → ubuntu

Once you're in, you have full sudo rights — no password prompt.

If you have more than one SSH key

Tell SSH exactly which key to use with -i, and add -o IdentitiesOnly=yes so it sends only that one:

ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes ubuntu@YOUR_SERVER_IP

-i on its own is not enough. Without IdentitiesOnly, SSH still offers every other key it can find first, the server counts each one as a failed attempt, and it disconnects you before reaching the key you named — with the same Permission denied (publickey) error you'd get if the key were wrong.

To make it permanent, add an entry to ~/.ssh/config:

Host my-server
    HostName YOUR_SERVER_IP
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Then just run ssh my-server.

If you have no SSH key on the server

SSH is key-only. Password login over SSH is switched off on every server we build, deliberately — a password that could open a sudo account from anywhere on the internet is not a risk worth carrying. No amount of retrying with a password will get you in over SSH.

That does not lock you out. Every new server is also created with a temporary password for its default user, shown once when the server finishes building. That password works in the browser terminal — your keyless way in, and the one that always works:

1. Go to Virtual Machines in the dashboard
2. Find your server and click the SSH button
3. Enter the temporary password if prompted — you'll be asked to choose a new one on first use

Didn't copy it? Open the server in the dashboard and use Reset password to set a new one. It is a console credential, so resetting it does not enable password login over SSH.

Reaching a server that has no public IP

Servers without a public IPv4 address aren't reachable from the open internet at all. That isn't a connection problem to debug — there is no route to them until you're on the same private network.

Two ways onto it:

• The browser terminal — already inside the network, needs no key and no public IP
• WireGuard VPN — puts your own laptop on the private network, so every instruction on this page works unchanged: same username, same key, same ssh command, using the private IP from the dashboard

Generate your credentials in the VPN Access tab and import them into the WireGuard client. Full walkthrough: Networking → VPN access.

Generating an SSH key pair

SSH keys are more secure than passwords and much more convenient — you'll never need to type a password to log in. Here's how to create one.

On macOS or Linux

Open Terminal and run:

ssh-keygen -t ed25519 -C "your@email.com"

When prompted for a file location, press Enter to use the default. You can optionally set a passphrase for extra security.

This creates two files:

• ~/.ssh/id_ed25519 — your private key (keep this safe, never share it)
• ~/.ssh/id_ed25519.pub — your public key (this is what you add to BareMeta)

On Windows (PowerShell)

ssh-keygen -t ed25519 -C "your@email.com"

The keys are saved to C:\Users\YourName\.ssh\

View your public key

# macOS / Linux
cat ~/.ssh/id_ed25519.pub

# Windows PowerShell
type $env:USERPROFILE\.ssh\id_ed25519.pub

Copy the entire output — it starts with ssh-ed25519 and ends with your email address.

Adding your SSH key to BareMeta

1. In the dashboard, click SSH Keys in the left sidebar
2. Click + Add SSH Key
3. Give it a name (e.g. "My MacBook") and paste your public key
4. Click Add Key

Every key on your account is installed on new servers by default — you don't have to remember to pick one. If you want a server to carry only some of your keys, tick just those in the SSH keys step when you create it. Local terminal SSH also requires a reachable public IP or a VPN connection to that server.

Troubleshooting connection issues

Permission denied (publickey)

The server was reached and rejected your credential. Your network, firewall rules, and the server itself are all fine — this is only about which key was offered and which user you asked for. Work through these in order:

• Are you using the right username? It comes from the operating system, not from your account — see the list above for the username each image uses. It is never root, and never your own username.
• Do you have several keys? Add -o IdentitiesOnly=yes alongside -i, or SSH may be disconnected before it offers the right one.
• Was the key on the server when it was built? Keys are installed at creation time only. A key you added to your account afterwards is not on that server, and cannot be pushed to it.
• Is the key in the same organisation as the server? A key registered under a different organisation is not available to it.

To see exactly which key your machine offered and what the server said:

ssh -v -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes ubuntu@YOUR_SERVER_IP

Locked out either way? You are not stuck. The browser terminal needs neither a key nor a reachable IP — see If you have no SSH key on the server — then add your key to ~/.ssh/authorized_keys from there.

Connection refused or timed out

Unlike Permission denied, these mean you never reached the server's SSH service at all.

• Check the server is running in the dashboard
• Verify the IP address is correct, and that it's a public IP — a private IP is only reachable over the VPN or from the browser terminal
• Check your firewall rules — port 22 must be open

Host key verification failed

This can happen if you recreate a server with the same IP. Remove the old key:

ssh-keygen -R YOUR_SERVER_IP