[GH-ISSUE #574] If I already have my own ssh keypair, how do I use them instead of automatically generated keypair? #150

New issue

Open

opened 2026-05-07 00:19:25 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:19:25 +02:00

Owner

Originally created by @gobiursus on GitHub (Aug 25, 2025).
Original GitHub issue: https://github.com/ovh/the-bastion/issues/574

Hi,
Before I even heard of the-bastion, I was already using a SSH keypair. How do I use my existing SSH keypair instead of using the automatically generated SSH keys?
Thank you

Originally created by @gobiursus on GitHub (Aug 25, 2025). Original GitHub issue: https://github.com/ovh/the-bastion/issues/574 Hi, Before I even heard of the-bastion, I was already using a SSH keypair. How do I use my existing SSH keypair instead of using the automatically generated SSH keys? Thank you

BreizhHardware commented

2026-05-07 00:19:26 +02:00

Author

Owner

@speed47 commented on GitHub (Sep 10, 2025):

This is not officially supported, because the idea is that if/whether a private key leaves the bastion, they should be considered as compromised. In other words, if importing preexisting private keys was possible, if later they are found out to be compromised, there would be no way to know whether this was before they were imported on the bastion, or due to a bug/vulnerability in it.

Now, if you still want to do it, it's possible, as long as you are okay with manually pushing them on the bastion server. The easiest way to do it is to simply replace a preexisting private/public keypair by the keypair you'd like to import.

There are 2 cases: importing egress keys for a group, or importing keys for a personal account.

For a group, keys are located there:

/home/keykeeper/keyGROUPNAME/id_ALGO_groupname.TIMESTAMP
/home/keykeeper/keyGROUPNAME/id_ALGO_groupname.TIMESTAMP.pub

So, for a group named "example", having an ed25519 keypair, this would be:

/home/keykeeper/keyexample/id_ed25519_example.1724152995
/home/keykeeper/keyexample/id_ed25519_example.1724152995.pub

If you replace the contents of these files with your own preexisting keypair, this will work. take care not to change the ownerships of the files, though.

For an account, keys are located there:

/home/ACCOUNT/.ssh/id_ALGO_private.TIMESTAMP
/home/ACCOUNT/.ssh/id_ALGO_private.TIMESTAMP.pub

You may also replace the contents of these files.

To check that the changes you made are valid, you can use groupInfo and accountListEgressKeys.

@speed47 commented on GitHub (Sep 10, 2025): This is not officially supported, because the idea is that if/whether a private key leaves the bastion, they should be considered as compromised. In other words, if importing preexisting private keys was possible, if later they are found out to be compromised, there would be no way to know whether this was before they were imported on the bastion, or due to a bug/vulnerability in it. Now, if you still want to do it, it's possible, as long as you are okay with manually pushing them on the bastion server. The easiest way to do it is to simply replace a preexisting private/public keypair by the keypair you'd like to import. There are 2 cases: importing egress keys for a group, or importing keys for a personal account. For a group, keys are located there: ``` /home/keykeeper/keyGROUPNAME/id_ALGO_groupname.TIMESTAMP /home/keykeeper/keyGROUPNAME/id_ALGO_groupname.TIMESTAMP.pub ``` So, for a group named "example", having an ed25519 keypair, this would be: ``` /home/keykeeper/keyexample/id_ed25519_example.1724152995 /home/keykeeper/keyexample/id_ed25519_example.1724152995.pub ``` If you replace the contents of these files with your own preexisting keypair, this will work. take care not to change the ownerships of the files, though. For an account, keys are located there: ``` /home/ACCOUNT/.ssh/id_ALGO_private.TIMESTAMP /home/ACCOUNT/.ssh/id_ALGO_private.TIMESTAMP.pub ``` You may also replace the contents of these files. To check that the changes you made are valid, you can use `groupInfo` and `accountListEgressKeys`.