'Access Denied' on the SSH Management tab

The user CtrlOps logged in as can't read or write `~/.ssh/authorized_keys`. The tab needs root or sudo with NOPASSWD. Reconnect as root, or have your sysadmin enable NOPASSWD for your user.

'Sudo Password Required' on the SSH Management tab

Same problem as above with a different message. CtrlOps can't run sudo because the server still asks for a password. Either log in as a user with passwordless sudo, or as root directly.

My new key was added but I still can't log in

Three things to check, in order: The server's `~/.ssh/authorized_keys` permissions must be `600`, and `~/.ssh` must be `700`. Run `ls -la ~/.ssh` in the AI Terminal. SELinux on RHEL/CentOS can block keys. Run `restorecon -R -v ~/.ssh` to fix labels. Make sure you're connecting as the right user, the key only authorises one specific Linux user.

The Add Key modal says 'Key already exists'

That exact public key is already in `authorized_keys`. Either it's already authorised, or another row has the same key under a different comment. Look for it in the table.

I can't create a new user role

Creating a system user writes to the server, so it needs root or sudo. If you connected as a read-only system user (or a user without sudo), the + Create User action can't complete. Reconnect as `root` or a read/write (sudo) user and try again.

I can't revoke a key or remove a user

Same cause: a read-only system user can't modify `authorized_keys` or delete users. Revoking and removing need root or a read/write (sudo) system user. Reconnect with the right access and the Revoke and delete actions become available.

SSH Key Management - Manage SSH Keys

CtrlOps gives you a complete SSH key management workflow - generate SSH keys through a guided GUI wizard, add SSH keys to any Linux server without touching the terminal, and manage every authorized key from a visual registry. Add, copy, revoke, and assign role-based access, all from a desktop app on Mac, Windows, or Linux.

Once you're connected to a server, the SSH Management tab is where you control who can log in: add an authorized key, see every key on the server, and revoke access in one click, all without editing authorized_keys by hand. You can also create system users with their own access level, so you can grant least-privilege access (read-only or read/write) without handing anyone full root. To add or connect servers in the first place, see Server Management; to manage access across your whole fleet from one screen, see Access Management.

What You Can Do - Manage SSH Keys Visually

Generate an SSH key pair (Ed25519 or RSA 4096) from a built-in GUI wizard - no terminal commands needed.
Add your SSH key to a server using ssh-copy-id, manual append, or cloud provider dashboard, with step-by-step instructions inside the app.
See every authorized key on a connected server in a visual registry.
Add one or more public keys at once.
Create custom system users with read/write or read-only access.
Target a key to a specific system user when you add it.
Filter the registry by system user to see who has which access.
Copy a key to reuse it on another server.
Revoke a key to remove that person's access immediately.

Generate an SSH Key (GUI Wizard)

If you don't have SSH keys yet, CtrlOps includes a built-in wizard that generates them for you - no terminal commands required. This is the fastest way to generate an SSH key using a GUI on Mac, Windows, or Linux. (Just need a quick key in the browser without installing anything? Our free SSH key generator covers that, and the SSH key management best practices guide explains how to look after keys across a whole fleet.)

Open the SSH Setup Wizard

Click SSH Setup (top right of Home, gear icon)

The wizard runs through three steps with a progress bar at the top.

Step 1 - SSH Installation Check

CtrlOps checks if SSH is installed on your computer. If it's found, you'll see the version and path. If not, you'll see platform-specific install instructions for Mac, Windows, and Linux. Follow them, then click Check Again.

When SSH is detected, click Next: Check SSH Keys.

Step 2 - Generate or View Your SSH Keys

If you already have keys, they're listed with key type, bit size, and a Copy Public Key button next to each. Skip ahead to Step 3.

If you don't have keys yet, fill in the form:

Field	What to enter
Key Type	Ed25519 (Recommended) - or RSA 4096 if your server only supports older keys
Email (Optional)	Used as a comment in the key file for identification

Click Generate SSH Key - Wait for the success toast

The key pair is saved in your computer's standard SSH directory (~/.ssh/). Click Next: Add to Server.

Step 3 - Add Your SSH Key to the Server

Three methods are provided. Pick whichever fits your setup:

Method	When to use
Method 1 (Recommended): Run `ssh-copy-id username@server-ip` from your terminal	When you can already log in with a password
Method 2: Manually append to `~/.ssh/authorized_keys`	When you have shell access through another tool
Method 3: Add through your cloud provider dashboard	First-time setup on AWS, DigitalOcean, GCP, etc.

A Detailed Setup Instructions section expands with pre-filled commands for the manual method:

Copy the public key (use the Copy Key button)
Connect to your server: ssh username@your-server-ip
Create the SSH directory: mkdir -p ~/.ssh
Append the key: echo "YOUR_PUBLIC_KEY" >> ~/.ssh/authorized_keys
Set file permissions: chmod 600 ~/.ssh/authorized_keys
Set directory permissions: chmod 700 ~/.ssh

Click Complete Setup to close the wizard. Your new key is ready to use when adding server connections.

Manage SSH Keys on a Server (SSH Management tab)

Inside a connected server, the SSH Management tab is where you control who can log in.

Open app → Click your server → Click the SSH Management tab

You'll see a stat row at the top with four counters: Registry (total), ED25519 (secure), RSA (standard), Access (other types). Below that is the Registry Governance card with an Active System User dropdown at the top right and the keys table, which includes a System User column showing what each key can log in as.

System Users and Roles

A server can have several system users, each with its own access level. The Active System User dropdown at the top of Registry Governance lets you switch between them and create new ones.

The dropdown lists:

All Users (default) - every key on the server.
Each existing system user with its level badge, e.g. root (SUDO), ubuntu (STANDARD), plus any custom roles you create.
+ Create User - opens the form to add a new system user (see below).

Filter the registry by system user. Pick a system user from the dropdown to show only the keys that can log in as that user. For example, choose ubuntu to see just the keys with ubuntu access. Switch back to All Users to clear the filter. The System User column in the table shows the same information per key as ROOT, UBUNTU, or custom-role badges.

Each access level grants different rights:

System user / role	Rights
root	sudo - full admin (read, write, update, delete, run anything)
ubuntu (standard)	read, write, update, and delete
Custom read/write	read and write, but cannot delete
Custom read-only	read only - no add, edit, delete, or running arbitrary scripts

Create a Custom User Role

Instead of giving everyone the same access you have, you can create a system user with exactly the rights you want and authorize keys against it.

Open the Create User form

Open the Active System User dropdown → Click + Create User

A modal opens titled Create User, "Create a new Linux system user."

Enter a username

Type a Username for the new system user, e.g. jsmith.

Pick the access level

Choose one:

Option	What it grants
Read / Write Access	Standard interactive user with write permissions. They can read and work on the server but cannot delete.
Read Only Access	Restricted shell access. They can read the server but cannot write, delete, or run arbitrary scripts.

Create

Click Create User (or press Enter)

The new system user is created on the server and appears in both the Active System User and Target System User dropdowns, ready to authorize keys against.

Use Read Only Access for auditors or contractors who should look but never change anything, and Read / Write Access to let someone work without delete rights or sudo. Reserve root for people who genuinely need full admin.

Add an SSH Key to a Server

Open the Add Key form

Click Add Key (top right of the Registry Governance section)

A modal opens titled Add SSH Key, "Securely import keys to your registry."

Choose the target system user

Pick the Target System User from the dropdown, root, ubuntu, or any custom role you created (such as readwrite). This decides which system user the key can log in as, and so what access the key holder gets.

Paste the public key

Paste the contents of a .pub file. You can paste several keys at once, press Enter for a new line to add multiple keys in one go. A pulse-dot indicator shows "N Keys Detected, all will be added" as you paste.

Save

Click Import Key

A toast confirms "Key added". The new key appears in the table immediately with a "SYNCING" label until the server confirms.

Only the public half of a key pair goes here. It's the file ending in .pub. Never paste a private key into this field.

View and Audit Your SSH Keys

The keys table has five columns:

Column	What it shows
Name / Identity	The key's comment or "Unnamed Signature" if blank
Signature	Type badge (ED25519 in green, RSA in blue)
Public Key Identity	The key string, blurred by default. Hover for the "CLICK TO REVEAL" tooltip, click to show full key.
System User	Badges (ROOT, UBUNTU, or a custom role) for the system user(s) this key can log in as
Actions	Copy and Revoke buttons

Copy a Key

Click the Copy icon in the Actions column

A toast confirms "Key copied to clipboard". Useful when you want to add the same key to another server.

Revoke an SSH Key (Remove Access)

Click Revoke (red trash icon) on the row

A confirmation pops up titled "Revoke Key Access?" with the warning "This will immediately terminate target login signature."

Confirm

Click Revoke Now

The key is removed from the server's authorized_keys file immediately. The user with that key can no longer log in.

Revoking takes effect right away. Make sure you still have at least one other working key, or password access, before revoking the key you're currently using to connect, otherwise you'll lock yourself out.

Tips

Always test a new key by opening a fresh CtrlOps connection in another window before revoking the one you're using. If something is wrong, you still have a way in.

Prefer Ed25519 keys for new setups. They're shorter, faster, and at least as secure as RSA 4096.

Add a meaningful comment (the Email field in the wizard) when generating a key. When you have keys from multiple machines on a server, the comment is the only way to tell them apart in the registry.

SSH Key Management